Attempt to prevent false positive detections by Windows Defender #443
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
~ psh
> cd "\\wsl.localhost\Ubuntu-22.04\home\kachick\repos\dotfiles"
kachick\repos\dotfiles via 🐹 v1.22.1 psh
> go build
go: RLock go.mod: Incorrect function. |
cp -r "\\wsl.localhost\Ubuntu-22.04\home\kachick\repos\dotfiles" .\tmp\
cd .\tmp\dotfiles\
go build -o dist ./...
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File .\dist\winit-conf.exe
Scan starting...
CmdTool: Failed with hr = 0x80508023. Check C:\Users\YOU\AppData\Local\Temp\MpCmdRun.log for more information |
dotfiles rebel-for-ms-cop(e385403) ≡via 🐹 v1.22.1 psh
! & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$(pwd)\dist\mksym.exe"
Scan starting...
Scan finished.
Scanning C:\Users\YOU\tmp\dotfiles\dist\mksym.exe found no threats.
dotfiles rebel-for-ms-cop(e385403) ≡via 🐹 v1.22.1 psh
! & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$(pwd)\dist\winit-conf.exe"
Scan starting...
Scan finished.
Scanning C:\Users\YOU\tmp\dotfiles\dist\winit-conf.exe found no threats.
dotfiles rebel-for-ms-cop(e385403) ≡via 🐹 v1.22.1 psh
> & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$(pwd)\dist\winit-reg.exe"
Scan starting...
Scan finished.
Scanning C:\Users\YOU\tmp\dotfiles\dist\winit-reg.exe found no threats. |
|
💭 Getting GitHub artifact needs the auth header https://docs.github.com/ja/rest/actions/artifacts?apiVersion=2022-11-28#get-an-artifact, I want release #417 |
|
https://github.com/kachick/dotfiles/actions/runs/8183096127/job/22375449050 🤔 Why skipped the 👮♂️ |
|
🎉 💭 But ... why detected in my client with same logic binary... |
Still detect for this zip 😠 |
Looks different with my local How to use AddDynamicSignature? https://github.com/MicrosoftDocs/microsoft-365-docs/blob/72fee082b7dd7f5549ee2f4d50563810e6f4aafc/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md?plain=1#L66 |
& "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -DynamicSignaturesIt removes all dynamic signatures and Then my artifact will not be detected as CI, so this is the guilty reason... |
|
I need MS help to beat MS
|
|
|
|
Enabling all, but empty list Toggled some options and wait some times, the list appeared again. I didn't know which option is the treasure... |
|
|
|
|
|
|
|
|
Merged
|
https://github.com/kachick/dotfiles/actions/runs/8188096063 detect - 956b773 956b773...8eca3a6 ??? 🤷♂️ Hmm... if #444 (comment) Maybe he works for us as a linter 🤣 🙄 Then I wish to use it as a CLI... |
kachick
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ResolvesCloses #442