Skip to content

Unable to install FlareVM

I have added the role for flarevm with the following command:

ludus ansible role add badsectorlabs.ludus_flarevm --user analyst

Below is the configuration file:

  - vm_name: "{{ range_id }}-flare"
    hostname: "{{ range_id }}-flare"
    template: win11-22h2-x64-enterprise-template
    vlan: 50
    ip_last_octet: 100
    ram_gb: 8
    cpus: 4
    windows:
      install_additional_tools: true
    roles:
      - badsectorlabs.ludus_flarevm

It gives me the following error:

TASK [badsectorlabs.ludus_flarevm : Disable Defender 1] ************************
fatal: [analyst-flare]: FAILED! => {"changed": true, "debug": [], "error": [{"category_info": {"activity": "", "category": "ParserError", "category_id": 17, "reason": "ParentContainsErrorRecordException", "target_name": "", "target_type": ""}, "error_details": null, "exception": {"help_link": null, "hresult": -2146233087, "inner_exception": null, "message": "At line:1 char:1\r\n+ Add-MpPreference -ExclusionPath 'C:\\'\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThis script contains malicious content and has been blocked by your antivirus software.", "source": null, "type": "System.Management.Automation.ParentContainsErrorRecordException"}, "fully_qualified_error_id": "ScriptContainedMaliciousContent", "output": "At line:1 char:1\r\n+ Add-MpPreference -ExclusionPath 'C:\\'\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nThis script contains malicious content and has been blocked by your antivirus software.\r\n    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException\r\n    + FullyQualifiedErrorId : ScriptContainedMaliciousContent\r\n \r\n", "pipeline_iteration_info": [], "script_stack_trace": "", "target_object": null}], "host_err": "", "host_out": "", "information": [], "output": [], "result": {}, "verbose": [], "warning": []}

It seems that the script being installed was flagged as malicious, even though I thought Windows Defender was already disabled before the installation. Could anyone help me resolve this?