Reduce false positives from MITRE ATT&CK behavioral signatures

[JamesDBartlett3]

VirusTotal flags the compiled binary with multiple MITRE ATT&CK signatures due to legitimate installer/credential management behaviors that resemble malware patterns: self-copying executable, PATH modification, COM automation, process spawning, encrypted credential storage, and native API calls.

Changes to Reduce Detection Surface

Application Manifest

• Add app.manifest with requestedExecutionLevel="asInvoker" and trustInfo sections
• Declare Windows 10/11 compatibility to signal legitimate Windows app

Assembly Metadata Enhancement

• Add AssemblyMetadata attributes for security model documentation
• Include publisher and security policy information AV vendors can parse

Logging Behavior

• Remove temp directory logging in PassphraseProvider.cs and PinentryServer.cs
• Temp file writes match T1027 (Defense Evasion) signature

Process Management

• Replace process.Kill(true) with graceful termination in GPG key import
• Forced process termination matches T1489 (Service Stop) signature

COM Automation Pattern

• Add explicit error handling around WScript.Shell creation
• Wrap in try-finally to release COM objects deterministically

Documentation

• Add XML doc comments explaining security model for sensitive operations
• Include README section on AV false positives with Defender exclusion instructions

Example: Manifest Addition

<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Expected Impact

Reduces detection from ~10-15 vendors to ~2-5 conservative vendors. Core functionality (credential storage + system modification) remains inherently suspicious to behavioral analysis. Code signing certificate would help but requires reputation buildup.

[JamesDBartlett3]

Opened ticket #793675 with Gridinsoft (only remaining vendor with a false positive on VirusTotal).

[JamesDBartlett3]

Still getting flagged by CAPE and Zenbox sandboxes.

VirusTotal link