Windows Defender blocks SharpHook.dll in signed .NET 8 application (Windows 11)

[anaghioss]

Problem

When distributing our production Windows application Desklog-Client, which uses
SharpHook, Windows Security (Defender) blocks SharpHook.dll
and shows the following warning to end users:

“Some features of Desklog-Client may not work because we can’t confirm who published SharpHook.dll”

Environment

• OS: Windows 11
• .NET Version: .NET 8
• SharpHook version: 7.0.0
• App type: Signed desktop application
• UI framework: Avalonia
• Processor: 13th Gen intel (R) core (TM) i5-13420H
• User System: ASUS EXPERTBOOK P1503CVA

So far, this behavior has been observed only on a specific client system.

We are happy to provide additional details if helpful.

[TolikPylypchuk]

Hi! Thanks for posting this issue!

Could you please specify how you sign your application? I've never seen such an issue, will try to investigate it.

[anaghioss]

Hi TolikPylypchuk,

Thanks for looking into this issue . Desklog-Client is a .NET 8 + Avalonia single-file publish app using Inno Setup installer, and we've isolated the "DLL not verified" error to this one system.

Signing Process

Inno Setup [Setup]:
SignTool=MsSign $f
DefaultDirName={localappdata}\Programs\Desklog-Client  
PrivilegesRequired=lowest

Signtool command:

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x86\signtool.exe" sign /sha1 78ef71290db4dc86c3dcd2246efe97d612cbdbda /tr http://timestamp.comodoca.com/ /td sha256 /fd sha256 $f

Uses Sectigo code signing certificate (thumbprint above).

Signs installer + all copied files including our app EXE during build.

SharpHook 7.0.0 DLL shows NotSigned via Get-AuthenticodeSignature.

Get-AuthenticodeSignature .\sharphook.dll | Select Status, SignerCertificate
output:
   Status SignerCertificate
   ------ -----------------
NotSigned

Issue Details
Works fine on all other systems.

In single-file publish, SharpHook DLL extracts at runtime from signed host EXE.

Error suggests Win11 security rejecting the unsigned native DLL on this specific hardware.

[TolikPylypchuk]

Thanks for the details! I'll try to look into it in more detail, but since I've never encountered this issue myself and it's reproduced only on a single machine, I'm not sure that I'll be able to do anything about it.

Also, as far as I understand, Authenticode signatures should be provided by application developers, not library developers. So, it's up to you to sign your application with your own certificate (which is not free to get).

[anaghioss]

Thanks for the clarification!