reduce-golang-detections-skill

A Claude Code skill for systematically reducing VirusTotal and EDR detection rates on compiled Go binaries through structural analysis, iterative A/B testing, and ML feature vector optimization.

A companion blog post will be linked here once published.

What this is

Modern EDR detections on Go binaries are dominated by statistical ML classifiers (e.g. Microsoft Wacatac.B!ml, ML.Attribute.HighConfidence, MalwareX-gen, Evo-gen) rather than fixed-byte YARA rules. Defeating an ML classifier is a fundamentally different problem from defeating a signature — renaming strings and swapping imports often makes detection worse, because the resulting binary diverges further from the vanilla toolchain baseline the classifier has learned as “normal.”

This skill packages a disciplined methodology for that problem:

• Triage detection type before remediation. Label every hit as YARA-style or ML-style. The fixes are different and not interchangeable.
• Change one variable per experiment. 10–20 samples per arm, control and variant built in the same VT upload window — Wacatac retrains on roughly a daily cadence, so a control batch from yesterday is not a valid A/B test.
• Measure with a comprehensive PE structural analyzer (included) before and after each change, and compare deltas against a vanilla binary from the same toolchain.
• Camouflage, not concealment. Give the classifier a believable answer to “what is this binary?” — mimicking the gopclntab symbol fingerprint of a single coherent large Go project consistently outperforms stripping, padding, or obfuscation.
• Recognize the irreducible floor. Once detection drops to ~15–25% on VirusTotal (the stochastic floor near the ML threshold), further structural optimization rarely pays back, and VT is not ground truth for real endpoints.

What’s in the box

Requirements

• Python 3 with pefile and lief (a venv is recommended; on PEP 668 systems use --break-system-packages if you must install system-wide).
• A VirusTotal API key.