Windows Defender flags an intentional reverse-shell test fixture when consuming semgrep-rules on Windows

[rapointofit]

Summary

Microsoft Defender detects and quarantines an intentional reverse-shell test
fixture when the semgrep-rules repository is materialized on Windows.

This report is not claiming that Semgrep is malicious or that the Defender
signature is incorrect. The affected file contains functional reverse-shell
code and appears to be an intentional fixture used to test the corresponding
Semgrep rule.

The usability issue is that consumers who retrieve the complete rules
repository can unexpectedly trigger endpoint-protection incidents even when
they only need the YAML/YML rule definitions.

Affected repository revision

Repository:
https://github.com/semgrep/semgrep-rules

Commit:
81634cfc9e68dc5f238a8062909a60ba34500648

Affected file:
python/lang/security/audit/python-reverse-shell.py

Git blob SHA:
a4760db32123f3ac5c54484a25297934ae40ce57

Associated rule:
python/lang/security/audit/python-reverse-shell.yaml

Defender detection

Threat name:

Backdoor:Python/Reverseshell!AMTB

Microsoft Defender status after remediation:

• DidThreatExecute: False
• IsActive: False
• ActionSuccess: True
• ThreatStatusErrorCode: 0

The fixture was quarantined before execution.

Environment

• Windows version: 25H2
• Windows build: 26200
• Microsoft Defender antimalware product version: 4.18.26060.3008
• PowerShell: 5.1.26100.8894
• Git for Windows: 2.54.0.windows.1
• Semgrep CE version intended for validation: 1.171.0

Impact

• Retrieving the complete rules repository can trigger a high-severity
  endpoint-protection alert.
• Defender quarantine can leave the local rules checkout incomplete.
• Users may incorrectly conclude that Semgrep or their application repository
  has been compromised.
• Users might be tempted to create unsafe Defender exclusions or restore the
  fixture from quarantine.
• Automated Windows-based CI or developer workflows can be interrupted.

Current workaround

We now retrieve only .yaml and .yml rule definitions using a blobless
partial clone and sparse checkout. We also verify that no non-rule files are
materialized.

This avoids downloading executable test fixtures and does not require a
Defender exclusion.

Suggested improvements

Would the Semgrep team consider one or more of the following?

1. Publish an official rules-only artifact that excludes executable test
   fixtures.
2. Document that the repository contains functional malware-like test samples
   that can trigger endpoint-protection products.
3. Provide an officially supported sparse-checkout example for consumers who
   only need rule definitions.
4. Add a warning to the repository README for Windows and endpoint-protected
   environments.

No Defender exclusion is being requested, and the affected fixture is not
attached to this issue.