Antivirus programs detect these tools for a reason. The Microsoft Toolkit is persistently detected as "HackTool:Win32/AutoKMS" or similar tags. This is not a false positive. The detection is correct because the software's sole purpose is to hack Microsoft's licensing system. Even if a third-party distributor is not malicious, the core functionality of the toolkit itself is flagged as a hack tool.
: Windows Defender and most reputable security software will flag and block it as a threat (often labeled as "AutoKMS"). microsoft toolkit ez activator 23 2 office 2013