The connection works when Windows Defender is disabled. Windows Defender doesn’t block it or notice its a malicious file, why would it block the outgoing connection?

Would i have to rely on Veil, Empire or TheFatRat to create something that would give me a connection if windows defender is enabled?