DefenderCheck - Identifies The Bytes That Microsoft Defender Flags On

2021-04-03T20:30:00
ID KITPLOIT:6444233334001756223
Type kitploit
Reporter KitPloit
Modified 2021-04-03T20:30:00

Description

Quick tool to help make evasion work a little bit easier.

Takes a binary as input and splits it until it pinpoints that exact byte that Microsoft Defender will flag on, and then prints those offending bytes to the screen. This can be helpful when trying to identify the specific bad pieces of code in your tool/payload.

Note: Defender must be enabled on your system, but the realtime protection and automatic sample submission features should be disabled.

Download DefenderCheck