KslDump

KslDump - BMVD Bring the Microsoft Vulnerable Driver Important context I reported the issue to Microsoft on 7 March 2026. However, almost 20 days earlier, the game-hacking community had already reversed and publicly discussed it. From my side, I do not follow their projects and I was not aware of...

cve-2021-1647

CVE-2021-1647 Microsoft Defender Remote Code Execution Vulnerability INFO Password:infected...

DefenderCheck

DefenderCheck Quick tool to help make evasion work a little bit easier. Warning: As of the 1.337.157.0 Defender signature update, DefenderCheck is classified as VirTool:MSIL/BytzChk.C!MTB. As a workaround while I work to get around this, please disable Real-time Protection in Defender before...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

Invoke-DumpMDEConfig

DumpMDEConfig PowerShell Script Overview Invoke-DumpMDEConfig is a PowerShell script designed to extract and display Microsoft Defender configuration and logs, including excluded paths, enabled ASR rules, allowed threats, protection history, and Exploit Guard protection history. The script provid...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

CVE-2026-41091-PoC-Exploit

☀️ CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Microsoft Defender Link Following Vulnerability - Local Privilege Escalation to NT AUTHORITY\SYSTEM The vulnerability is known as "RedSun" 🎯, "SolarFlare" is the name I gave to my exploit. ✅ 📌 Overview This repository contains...

CVE-2026-50656

🚨 CVE-2026-50656 — Microsoft Defender "RoguePlanet" Vulnerabilidad de Elevación de Privilegios en el Motor de Protección contra Malware de Microsoft ⚠️ Solo para Investigación de Seguridad Educativa y Defensiva 📖 Resumen CVE-2026-50656 es una vulnerabilidad de Elevación de Privilegios EoP de alta...

CVE-2026-50656-rogueplanet-validation

RoguePlanet PoC Validation Report for Microsoft Defender Purpose and scope of the report This report concerns the validation of the publicly described RoguePlanet PoC related to Microsoft Defender. The described technique was presented in the media on 10 June 2026 as a Local Privilege Escalation...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Microsoft Defender Local Privilege Escalation LPE BlueHammer is a high-severity Local Privilege Escalation vulnerability affecting Microsoft Defender components on Windows systems. The flaw allows a low-privileged attacker to escalate privileges to NT...

CVE-2026-41091

🛡️ CVE-2026-41091 - RedSun Microsoft Defender Elevation of Privilege Vulnerability RedSun is a local privilege escalation LPE technique and associated PoC abusing a link-following vulnerability in Microsoft Defender's Malware Protection Engine. It allows a low-privileged authenticated attacker to...

Vulnerability-scanner

With the increasing reliance of organizations on digital technologies to carry out communication, data storage, and business operations, the threats to cybersecurity have significantly increased. Given the critical role that endpoint security software plays in securing networks and systems, such...

Exploit-Win32.CVE-2017-0147.A

Exploit-Win32.CVE-2017-0147.A Der Name des Virus ist die Erkennung von Microsoft Defender, ist der typische Antivirus...

Exploit-Win32.CVE-2012-0158.F.doc

Exploit-Win32.CVE-2012-0158.F.doc il nome del virus è il rilevamento di Microsoft Defender, è il tipico antivirus...

defender-privilege-escalation-scanner

Scanner di Vulnerabilità di Defender Scanner di vulnerabilità di Microsoft Defender — CVE-2026-41091 / CVE-2026-45498 Rileva le debolezze di sicurezza nelle distribuzioni di Microsoft Defender. Solo per test di sicurezza autorizzati. Caratteristiche Rilevamento CVE-2026-41091 Rilevamento...

Dent

QUESTO REPOSITORY È STATO ARCHIVIATO Per visualizzare l'ultima versione di Dent o per inviare un problema, fare riferimento a https://github.com/Tylous/Dent. Dent Ulteriori informazioni Se vuoi saperne di più sulle tecniche utilizzate in questo framework, dai un'occhiata a questo articolo...

redsun-bluehammer-undefend-detection-pack

Pacchetto di Rilevamento RedSun, BlueHammer, UnDefend e CrossFamily IMPORTANTE: Tutto il codice e la logica di rilevamento in questo repository è generata da intelligenza artificiale. Non vi è alcuna garanzia che questi script siano corretti, completi, sicuri o adatti a qualsiasi ambiente...

CVE-2026-33825

🔨 CVE-2026-33825: BlueHammer Microsoft Defender Elevation of Privilege 📌 Descrizione Generale La vulnerabilità CVE-2026-33825 , soprannominata "BlueHammer" , è una falla critica di Escalation dei Privilegi Locali EoP nel motore di remediation delle minacce di Microsoft Defender. 🚨 Impatto Critico...

hoaxshell

hoaxshell ⚡ The latest version of this project is the HoaxShell standalone listener which comes with refreshed payload templates. Wou can also use it directly from https://revshells.com make sure to choose hoaxshell as the listener. ⚠️ As of 2022-10-18, hoaxshell is detected by AMSI...

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days

Executive Summary ShieldBreak CVE-2026-69414 is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigne...