Wacatac false positive outbreak?

Hello, I'm Greg, here to help you with this.

See Glen Prouty's post here about determining if Wacatac is a false positive and how to remove it:
https://answers.microsoft.com/en-us/windows/for...

If/when in doubt, Defender gives adequate real time protection but when it finds something or you suspect you're infected, you'll want to roll out the bigger artillery to know you're getting the very best and most thorough scans. For this we should use the tech industry's undisputed leading scanners Malwarebyte on-demand protection for malware, and AdwCleaner for the lower level threats and PUPs.

You can do this most thorough disinfection procedure to find and root out infection wherever it hides, then repair any system files that were corrupted:
https://answers.microsoft.com/en-us/windows/for...

Then you will know for sure, and be rid of it either way.

Feel free to ask back any questions. Based on the results you post back, I will have other suggestions if necessary.

https://www.bleepingcomputer.com/news/security/winrar-sfx-archives-can-run-powershell-without-being-detected/ 

It's likely that detections have been beefed up to handle threats outlined in the above article, but in the process there are a lot of false positive detections. Wacatac.H!ml indicates it is a machine learning detection, which is prone to FP.

Hopefully Microsoft will adjust the ml threshold.