yetAnotherObfuscator

yetAnotherObfuscator A C obfuscator tool that can bypass Windows Defender antivirus. I made this tool mainly as an excuse to learn more about C and how obfuscators function. This is an alpha release, so expect some nice bugs. Usage: Drag drop the C exe into yetAnotherObfuscator.exe Or provide the...

maps_scanner

MAPS Cloud Scanner A research tool for interacting with Windows Defender's MAPS Microsoft Active Protection Service cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender's real-time protection verdicts, sample submission pipeline, and...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

Nim-Reverse-Shell

Nim Reverse Shell A simple reverse shell written in Nim that bypasses Windows Defender detection see the "Tested Operating Systems" section below for more details. This code is made for educational purposes only. Tested Operating Systems Windows 10 10.0.19045 Windows 11 10.0.22621 Compilation The...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

experiments

Experiments Repository of various experiments / PoC. debugging-secure-kernel: PoC gdb debugging the Windows 10 secure kernel, on top of QEMU KVM dns: Experiments regarding DNS / Certificate transparency / Homoglyphs Attack Surface Reduction: Demystifying Windows Attack Surface Reduction internals...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty RoguePlanet Windows Defender Vulnerability Authors: Original Exploit Developer Nightmare-Eclipse Developing, testing, and weaponization nu11secur1ty Penetration Testing Engineer 🧠 Technical Analysis by nu11secur1ty The exploit leverages a rac...

Defender_Exclusions-BOF

Defender Exclusions BOF What A BOF to determine Windows Defender exclusions: Extensions Processes Folders Why Examples of using the C++ compiler to create BOFs without the need for the intermediary vtable dereferences. Building cd src make all Usage 1. Load dist/cEnumerateDefender.cna 2. Run in a...

WDExtract

WDExtract Extract Windows Defender database from vdm files and unpack it This program is distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

CheckPlz

CheckPlz CheckPlz is an Rust adaptation of the populars ThreatCheck & GoCheck tools, designed to scan files for potential threats while leveraging AMSI Antimalware Scan Interface and Windows Defender. By isolating malicious content with precision and providing comprehensive analysis, CheckPlz...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

AMSIext

AMSIext AMSIext is a Firefox and Chrome plugin that allows you to send any data stream from the browser to AMSI. AMSI is the way to communicate RAM memory with Windows Defender or any other endpoint security system. This means that while browsing the web, AMSIext will alert you to malicious...

Lockbit3.0-MpClient-Defender-PoC

Lockbit3.0-MpClient-Defender-PoC Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC Based on: LockBit ransomware abuses Windows Defender to load Cobalt Strike https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/ How to test by...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

SNEK_Equinox

SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...

nim-shell

Nim-Shell Reverse shell that can bypass EDR and windows defender detection Please do not upload to VirusTotal 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦 $ apt install nim Compilation nim c -d:mingw --app:gui nimshell.nim Change the IP address and port number you want to listen to in the nimshell.nim file accordin...