[butvacuum]

More likely/precisely, it's flagged as malware because it's bypassing protections build into windows credential guard- eg, impersonating(or injecting code into) outlook.exe.

making an exception for such a heuristic is, in all cases, wrong since it will always be abused.

The actual answer is: Defender needs a PUP category.