I recently unpacked an old archive from the time I was making some shareware few decades ago. Windows Defender instantly ate all keygen.exe files from it. Those keygens were my own keygens for my own software (I wrote them myself and used them to generate keys for my customers back in the day).
Did you have catchy chiptunes and graffiti ANSI art?
No, it was just a plain Windows form, built from scratch using a then-popular Windows IDE. I think it was mostly triggered by the file name, maybe in combination with some crypto code inside.