Reduce sandbox false positives by replacing Task.Delay timeout pattern

[Copilot]

CAPE and Zenbox sandboxes flag the binary with MITRE ATT&CK signatures (T1497, T1106, T1082, T1562) due to .NET runtime behaviors and legitimate credential management APIs.

Code changes

• Replace Task.Delay with CancellationTokenSource timeout in GPG key import flow
  • Task.Delay(30000) pattern triggers "long-sleeps" / "evasive loops" heuristics
  • CancellationTokenSource.CancelAfter() achieves same timeout without explicit delay call

// Before: flagged as evasive sleep
var timeoutTask = Task.Delay(30000);
var completedTask = await Task.WhenAny(process.WaitForExitAsync(), timeoutTask);

// After: standard cancellation pattern
using var cts = new CancellationTokenSource();
cts.CancelAfter(TimeSpan.FromSeconds(30));
await process.WaitForExitAsync(cts.Token);

Documentation

• Added sandbox false positive table to README explaining each MITRE signature:
  • T1497 → .NET GC/JIT memory management (guard pages, write watch)
  • T1106 → Windows Hello UserConsentVerifier API
  • T1082 → Console.IsInputRedirected for GPG agent detection
  • T1562 → DataProtectionProvider/DPAPI for passphrase storage

Limitations

Core detections (native API calls, memory patterns) are inherent to .NET runtime and Windows Hello APIs—cannot be eliminated without changing platforms.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.virustotal.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Reduce false positives from MITRE ATT&CK behavioral signatures</issue_title>
<issue_description>VirusTotal flags the compiled binary with multiple MITRE ATT&CK signatures due to legitimate installer/credential management behaviors that resemble malware patterns: self-copying executable, PATH modification, COM automation, process spawning, encrypted credential storage, and native API calls.

Changes to Reduce Detection Surface

Application Manifest

• Add app.manifest with requestedExecutionLevel="asInvoker" and trustInfo sections
• Declare Windows 10/11 compatibility to signal legitimate Windows app

Assembly Metadata Enhancement

• Add AssemblyMetadata attributes for security model documentation
• Include publisher and security policy information AV vendors can parse

Logging Behavior

• Remove temp directory logging in PassphraseProvider.cs and PinentryServer.cs
• Temp file writes match T1027 (Defense Evasion) signature

Process Management

• Replace process.Kill(true) with graceful termination in GPG key import
• Forced process termination matches T1489 (Service Stop) signature

COM Automation Pattern

• Add explicit error handling around WScript.Shell creation
• Wrap in try-finally to release COM objects deterministically

Documentation

• Add XML doc comments explaining security model for sensitive operations
• Include README section on AV false positives with Defender exclusion instructions

Example: Manifest Addition

<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Expected Impact

Reduces detection from ~10-15 vendors to ~2-5 conservative vendors. Core functionality (credential storage + system modification) remains inherently suspicious to behavioral analysis. Code signing certificate would help but requires reputation buildup.</issue_description>

<agent_instructions>This app is being flagged as malware by the CAPE and Zenbox sandboxes on VirusTotal.

Here's the link to the report: https://www.virustotal.com/gui/file/49c3c3c64e75f821a9a4d33dcecc5e2c749eed7b04fb322442d96a9d359e70c3/behavior

Some behaviors the sandboxes claim to have detected, and which they consider suspicious:

• Guard pages use detected: possible anti-debugging
• May sleep (evasive loops) to hinder dynamic analysis
• Allocates memory with a write watch (potentially for evading sandboxes)

Please determine what's causing these false positive malware detections and implement a fix.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@JamesDBartlett3 Opened ticket JamesDBartlett3/gpg-windows-hello#793675 with Gridinsoft (only remaining vendor with a false positive on VirusTotal). @JamesDBartlett3 Still getting flagged by CAPE and Zenbox sandboxes.

VirusTotal link</comment_new>

• Fixes Reduce false positives from MITRE ATT&CK behavioral signatures #3

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.