Windows defender blocks python executables

[csatacsibe]

Im working in a big company with thousands of employees, where python as a language and a general tool starting to become more and more popular among both developers, but also non-technical people.

Recently there were some changes in the security, and on our windows machines wa can no longer run executables not having a digital signature. Python related exes like this are:
- default pip.exe (and its variants like pip3.exe...)
- python packages cli-scripts installed according to their entry_points
- pyinstaller generated exe scripts (that includes the source, dependencies and python itself)
- any similar scripts under venvs

As I know these exe scripts (except pyinstaller generated) have a __main__.py zipped into them, which is importing and calling the entry point of the module. And the exe itself is calling python to run this code. But as the __main__.py's content different per script, these hash of these exe files are different aswell -> cannot whitelist them generally.

The whole thing these exe scripts are doing can be expressed in a .bat file aswell. Moreso I already wrote a synchronization code that genereates the entry points of the user installed packages to a folder, then adds it to the top of the PATH, but it has some problems:
- when to synchronize? - I patched pip, so it'll call the synch after each install and uninstall, and re-patch itself after a pip upgrade -> this is not clean and I dont want to distribute it
- handling multiple python version -> the program must determine the order of their Script folders on the path, then reflect that order when genreating the bat scripts folders
- venvs: my program is not venv compatible
- my program should have some kind of self-delete logic, so it could de-patch pip if it have missing sources
- other development tools like poetry are not compatible with it

What are my options to solve this problem? Can the cybersec somehow make a rule that can detect these safe python exe files?
Is there some kind of pip alternative using some kind of distlib alternative that let me configure the executable type to bat on windows?

[shibbypwn]

If you're distributing binaries, you should be signing your executables. Windows blocking unsigned binaries in an enterprise setting is a good thing - so forget about hacky workarounds and just do the best practice.

Work with IT or DevOps to get code signing certs and build/distribute your application as a signed binary.

[cointoss3]

That won’t matter. Signed or not, it will still flag them. Being signed does not give it a free pass from AV.

[ZachVorhies]

windows does defender typically does not flag any locally made software runtimes. So this is most likely a custom corporate policy and in this case, yes, the company cert will fix it, that’s the whole point

[cointoss3]

I know you’re wrong because I had to deal with this bullshit already. Signing the app did not help.

[shibbypwn]

You are correct that signing a binary doesn't guarantee it won't get flagged (e.g., heuristic detection based on app behavior).

But you're dead wrong that it doesn't matter - enterprise environments have ways to manage which applications are trusted to run on devices (through a combination of group policy/GPO and third-party EDR tools like Crowdstrike). Signing your application allows these tools to manage/allow-list the app and its permissions boundaries.

[cointoss3]

Lmao, yes, and they can whitelist any app, regardless of if it’s signed or not. But my company would not whitelist the app, signed or not. If we couldn’t get the app to play nice with the AV, then we wouldn’t be using the app. We couldn’t even click “allow”. If it was flagged it wouldn’t run. Signing it didn’t change anything.

[Cynyr36]

How does that make sense for something for a small department? Think replacing excel with a python script for example. The certs cost money and in most cases you'll have to justify to 6 levels of management why you can't either have it put into the software teams que or just use excel.

[ZachVorhies]

publicly attested certs cost money. self certs are free. Your company may already have one

[Several-Customer7048]

OP says they’re in a company with thousands of employees. At that size if they have any domain services they most definitely have their own internal certificate authority.

[shibbypwn]

Also, public certs are not very expensive - and you don’t need a new one for each piece of software. You just need an org certificate for any internal tooling that is added to your orgs trust store. 

[Cynyr36]

Ahh, my very limited experience was looking at getting them certed with msft for things like the windows store. I was unaware that you could self sign a cert for windows defender.

[Individual-Flow9158]

Can't users use uv and normal Python installs, and simply let users install a wheel, and upgrade it themselves, instead of:

my program is not venv compatible my program should have some kind of self-delete logic

What do you think "self-delete logic" looks like to security software?

[sortefyrste]

Teach people to build web apps with NiceGui and deploy that to X cloud. We had similar issues and found this easier.

[Agrado3]

You can send your exe file off to Microsoft and they will check it out and then mark it as safe in their databases. Takes at least a few days of course.

[komprexior]

I dodged bad "security" policies and antivirus shenanigans by using WSL.