Claude Code 技能，通过 PE 结构分析和严格的 A/B 测试，系统性降低已编译 Go 二进制的 VirusTotal/EDR 检测率。
概览
一项Claude代码技能，通过结构分析、迭代A/B测试和机器学习特征向量优化，系统性降低编译Go二进制文件上的VirusTotal和EDR检测率。 发布后将在这里链接配套的博客文章。 现代 Go 二进制的 EDR 检测主要由统计机器学习分类器（如 Microsoft Wacatac.B！ml、ML.Attribute.HighConfidence、MalwareX-gen、Evo-gen）而非固定字节的 YARA 规则所主导。破解机器学习分类器与破解签名是根本不同的问题——重命名字符串和交换导入通常会使检测更差，因为最终的二进制与分类器已学会的“正常”标准工具链基线更为偏离。 该技能为该问题提供了一套严谨的方法论： - 将每个命中标记为YARA风格或ML风格。修复方法不同且不可互换。
概述（AI 翻译）
一项Claude代码技能，通过结构分析、迭代A/B测试和机器学习特征向量优化，系统性降低编译Go二进制文件上的VirusTotal和EDR检测率。
一篇配套博客文章发布后将链接在此。
这是什么
现代 Go 二进制的 EDR 检测主要由统计机器学习分类器（例如 Microsoft Wacatac.B!ml、ML.Attribute.HighConfidence、MalwareX-gen、Evo-gen）而非固定字节的 YARA 规则。破解机器学习分类器与破解签名是根本不同的问题——重命名字符串和交换导入通常会使检测变得更差，因为最终的二进制与分类器已学会的“正常”标准工具链基线相径更远。
该技能为该问题提供了一套严谨的方法论：
- 修复前的分诊检测类型。 将每次命中标记为YARA风格或ML风格。修复方法不同且不可互换。
- 每个实验更换一个变量。 每个臂、对照组和变异组在同一VT上传窗口内构建10–20个样本——Wacatac大致以每日频率进行重新训练，因此昨天的对照批次不算有效的A/B测试。
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
reduce-golang-detections-skill
A Claude Code skill for systematically reducing VirusTotal and EDR detection rates on compiled Go binaries through structural analysis, iterative A/B testing, and ML feature vector optimization.
A companion blog post will be linked here once published.
What this is
Modern EDR detections on Go binaries are dominated by statistical ML classifiers (e.g. Microsoft Wacatac.B!ml, ML.Attribute.HighConfidence, MalwareX-gen, Evo-gen) rather than fixed-byte YARA rules. Defeating an ML classifier is a fundamentally different problem from defeating a signature — renaming strings and swapping imports often makes detection worse, because the resulting binary diverges further from the vanilla toolchain baseline the classifier has learned as “normal.”
This skill packages a disciplined methodology for that problem:
- Triage detection type before remediation. Label every hit as YARA-style or ML-style. The fixes are different and not interchangeable.
- Change one variable per experiment. 10–20 samples per arm, control and variant built in the same VT upload window — Wacatac retrains on roughly a daily cadence, so a control batch from yesterday is not a valid A/B test.
- Measure with a comprehensive PE structural analyzer (included) before and after each change, and compare deltas against a vanilla binary from the same toolchain.
- Camouflage, not concealment. Give the classifier a believable answer to “what is this binary?” — mimicking the gopclntab symbol fingerprint of a single coherent large Go project consistently outperforms stripping, padding, or obfuscation.
- Recognize the irreducible floor. Once detection drops to ~15–25% on VirusTotal (the stochastic floor near the ML threshold), further structural optimization rarely pays back, and VT is not ground truth for real endpoints.
What’s in the box
| File | Purpose |
|---|---|
SKILL.md |
The skill itself — methodology, prerequisites, phased workflow, and the core principles above. Load this into Claude Code. |
pe_structural_analyzer.py |
Standalone Python analyzer that extracts the full PE structural feature vector (sections, imports, exports, resources, gopclntab, entropy, etc.) and produces a baseline/delta JSON report. |
references/pe-structural-analyzer.md |
How to run the analyzer and interpret its output. |
references/pe-structural-features.md |
Catalog of structural features observed across vanilla vs. modified Go builds, with which features actually correlate with detection. |
references/experiment-categories.md |
Catalog of experiment categories that have and have not worked in practice, including dead ends to avoid. |
Requirements
- Python 3 with
pefileandlief(a venv is recommended; on PEP 668 systems use--break-system-packagesif you must install system-wide). - A VirusTotal API key.
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add praetorian-inc/reduce-golang-detections-skill