content: A script that modifies the hosts file, when the description clearly says that's what it does, is not a trojan. Windows Defender is thus mislabeling the script and taking action based upon that mislabeling. Whether that is "as designed".... well, that's probably true, because it's called "Windows Defender," not "User Defender."