[GH-ISSUE #16] Windows Defender flags benchmark deliverables as Backdoor:PHP/Perhetshell.* during local use #2

New issue

Closed

opened 2026-02-27 07:19:56 +03:00 by kerem · 1 comment

kerem commented

2026-02-27 07:19:56 +03:00

Owner

Originally created by @jdev-02 on GitHub (Dec 1, 2025).
Original GitHub issue: https://github.com/KeygraphHQ/shannon/issues/16

Summary

While setting up Shannon on a Windows dev machine, Windows Defender reported several Backdoor:PHP/Perhetshell.* detections inside the xben-benchmark-results folder (and related deliverables). The detections appear to be triggered by exploit payloads stored in markdown/log/json benchmark artifacts, not by executable PHP code.

This looks like an AV false positive on Shannon’s benchmark output, but it’s scary for first-time users and might discourage them from trying the tool.

Environment

OS: Windows 11 (Microsoft Defender enabled)
Clone: KeygraphHQ/shannon main
Operation: docker build -t shannon:latest . and general repo usage
AV: Microsoft Defender (built-in Windows Security)

Detected threats

Windows Defender reported:

Backdoor:PHP/Perhetshell.A!dha
Backdoor:PHP/Perhetshell.B!dha

All detections were inside Shannon’s repo, e.g.:

...\shannon\xben-benchmark-results\XBEN-022-24\deliverables\comprehensive_security_assessment_report.md
...\shannon\xben-benchmark-results\XBEN-041-24\deliverables\injection_analysis_deliverable.md
...\shannon\xben-benchmark-results\XBEN-041-24\deliverables\recon_deliverable.md
...\shannon\xben-benchmark-results\XBEN-079-24\audit-logs\agents\*_injection-vuln_attempt-1.log
...\shannon\xben-benchmark-results\XBEN-079-24\deliverables\injection_exploitation_queue.json
...\shannon\xben-benchmark-results\XBEN-079-24\deliverables\recon_deliverable.md

(All of these are text/markdown/log/json benchmark deliverables, not active PHP files.)

Steps to reproduce

Clone KeygraphHQ/shannon on a Windows machine with Defender enabled.
Open the folder in VS Code / run docker build -t shannon:latest . or otherwise let Defender scan the repo.
Watch Windows Security → Protection history.
Defender quarantines several files under xben-benchmark-results/**/deliverables and audit-logs/agents/*.

Observed behavior

Shannon itself appears fine; only benchmark deliverables get quarantined.
The quarantined files are PoC exploit reports (markdown, logs, JSON) from XBOW benchmark runs that contain payload strings resembling real PHP backdoors, which trip Defender’s signatures.
For a new user, the “Backdoor:PHP/Perhetshell” message during setup is pretty alarming and may look like Shannon is installing malware.

Expected / desired behavior

Shannon includes real exploit payloads as part of its research benchmarks, which is great. It would be helpful if:

Docs explicitly called this out for Windows users (e.g., a short note in the README and/or xben-benchmark-results/README.md about possible AV false positives on benchmark deliverables), and/or
The benchmark deliverables were:
- moved behind a separate download, or
- zipped / stored in a way that’s less likely to trigger AV, or
- excluded from the default Docker build context via .dockerignore.

This would make it clearer to new users that:

The detections are from intentionally malicious payloads in sample benchmark artifacts, not from the Shannon runtime itself.
It’s safe to delete or quarantine those artifacts without affecting Shannon.

Thanks

Shannon is a really cool project—happy to help iterate on the onboarding experience.
If it’s useful, I’m happy to open a PR to add a short “Antivirus false positives” note to the README and/or benchmark README.

Originally created by @jdev-02 on GitHub (Dec 1, 2025). Original GitHub issue: https://github.com/KeygraphHQ/shannon/issues/16 ### Summary While setting up Shannon on a Windows dev machine, Windows Defender reported several **Backdoor:PHP/Perhetshell.\*** detections inside the `xben-benchmark-results` folder (and related deliverables). The detections appear to be triggered by exploit payloads stored in **markdown/log/json benchmark artifacts**, not by executable PHP code. This looks like an AV false positive on Shannon’s benchmark output, but it’s scary for first-time users and might discourage them from trying the tool. --- ### Environment - OS: Windows 11 (Microsoft Defender enabled) - Clone: `KeygraphHQ/shannon` `main` - Operation: `docker build -t shannon:latest .` and general repo usage - AV: Microsoft Defender (built-in Windows Security) --- ### Detected threats Windows Defender reported: - `Backdoor:PHP/Perhetshell.A!dha` - `Backdoor:PHP/Perhetshell.B!dha` All detections were inside Shannon’s repo, e.g.: - `...\shannon\xben-benchmark-results\XBEN-022-24\deliverables\comprehensive_security_assessment_report.md` - `...\shannon\xben-benchmark-results\XBEN-041-24\deliverables\injection_analysis_deliverable.md` - `...\shannon\xben-benchmark-results\XBEN-041-24\deliverables\recon_deliverable.md` - `...\shannon\xben-benchmark-results\XBEN-079-24\audit-logs\agents\*_injection-vuln_attempt-1.log` - `...\shannon\xben-benchmark-results\XBEN-079-24\deliverables\injection_exploitation_queue.json` - `...\shannon\xben-benchmark-results\XBEN-079-24\deliverables\recon_deliverable.md` (All of these are text/markdown/log/json benchmark deliverables, not active PHP files.) --- ### Steps to reproduce 1. Clone `KeygraphHQ/shannon` on a Windows machine with Defender enabled. 2. Open the folder in VS Code / run `docker build -t shannon:latest .` or otherwise let Defender scan the repo. 3. Watch **Windows Security → Protection history**. 4. Defender quarantines several files under `xben-benchmark-results/**/deliverables` and `audit-logs/agents/*`. --- ### Observed behavior - Shannon itself appears fine; only **benchmark deliverables** get quarantined. - The quarantined files are PoC exploit reports (markdown, logs, JSON) from XBOW benchmark runs that contain payload strings resembling real PHP backdoors, which trip Defender’s signatures. - For a new user, the “Backdoor:PHP/Perhetshell” message during setup is pretty alarming and may look like Shannon is installing malware. --- ### Expected / desired behavior Shannon includes real exploit payloads as part of its research benchmarks, which is great. It would be helpful if: 1. **Docs explicitly called this out** for Windows users (e.g., a short note in the README and/or `xben-benchmark-results/README.md` about possible AV false positives on benchmark deliverables), and/or 2. The benchmark deliverables were: - moved behind a separate download, or - zipped / stored in a way that’s less likely to trigger AV, or - excluded from the default Docker build context via `.dockerignore`. This would make it clearer to new users that: - The detections are from **intentionally malicious payloads in sample benchmark artifacts**, not from the Shannon runtime itself. - It’s safe to delete or quarantine those artifacts without affecting Shannon. --- ### Thanks Shannon is a really cool project—happy to help iterate on the onboarding experience. If it’s useful, I’m happy to open a PR to add a short “Antivirus false positives” note to the README and/or benchmark README.

kerem closed this issue

2026-02-27 07:19:56 +03:00

kerem commented

2026-02-27 07:19:56 +03:00

Author

Owner

@ajmallesh commented on GitHub (Dec 3, 2025):

Thanks for the detailed report and flagging this! We'll discuss internally and update the README with guidance for Windows users. Will update this thread when the fix is deployed.

@ajmallesh commented on GitHub (Dec 3, 2025): Thanks for the detailed report and flagging this! We'll discuss internally and update the README with guidance for Windows users. Will update this thread when the fix is deployed.

kerem referenced this issue

2026-02-27 07:20:14 +03:00

[PR #2] [MERGED] Fixing bugs #58

kerem referenced this issue

2026-02-27 08:09:28 +03:00

[PR #163] [CLOSED] Nayatel pentestai #153

kerem referenced this issue

2026-02-27 08:09:28 +03:00

[PR #164] [CLOSED] Nayatel pentestai #155