Antivirus marks file as trojan\stealer

[p3test]

The ghostwriter-cli.exe file in the 2024 releases does not trigger antivirus programs and is not marked as a trojan or stealer. What could be the reason that this particular ghostwriter-cli.exe file falls under suspicion?

[p3test]

Perhaps this question has already been raised somewhere, but I couldn’t find it.

[chrismaddalena]

The wiki addresses this: https://www.ghostwriter.wiki/getting-started/managing-the-server-with-ghostwriter-cli

Ghostwriter CLI reads and writes to the .env file and Docker file and tries to establish an outbound network connection when you run the update and version commands. The CLI only writes to Ghostwriter’s files and only reads Ghostwriter’s .env and VERSION files. For network connectivity, it only connects to GitHub’s REST API to pull the version information for Ghostwriter and Ghostwriter CLI’s latest tagged releases. However, these actions taken by a downloaded binary will cause some anti-malware and EDR solutions to flag Ghostwriter CLI as malware. If you encounter an issue with such a solution blocking Ghostwriter CLI from executing, please add the binary to your allowlist or exclusions list.

We are working to try to get Ghostwriter CLI to be trusted, as it once was, but these issues come and go.

If you have concerns about this behavior, you can build Ghostwriter CLI from source. See the GitHub repository. Further, you can inspect the source code to verify its behavior and check the build hashes against the releases page.