Only the download source. Fake "MAS 2.6" executables on unknown forums are malware. Always verify the SHA-256 checksum on GitHub.
Windows Defender uses heuristic detection. Because MAS 2.6 attempts to modify ClipSVC (Client License Service) and edit hosts files to block Microsoft’s checking IPs, Defender classifies this behavior as "HackTool:Win32/Keygen." This is a generic tag for tools that bypass licensing, not malware. Latest Microsoft Activation Scripts -MAS- 2.6