Some powerful built-in Windows 11 programs are allowed to write files to Defender’s working directory:
\System32\msiexec.exe
\Register-CimProvider.exe
\svchost.exe
\lsass.exe
Tools and methods to find these whitelisted programs for other #antimalware
Github: /TwoSevenOneT/DefenderWrite
Challenge: Drop #mimikatz onto a drive with the latest Windows 11.
1. Found a way to write a file into Windows Defender’s working directory: Success ✅
2. Dropped "mimikatz.exe" into that folder: Failed 🛑
Conclusion: Windows Defender does not exclude its own executable folder
While I was trying to evade cloud-based EDRs, I accidentally found a way to temporarily block a client's machine network with a POC running as a Normal user.
Not using the Windows Filtering Platform (WFP) which requires Admin priv
I haven't thought of exploitation scenarios for this tool yet, it might be a dead-end #antimalware research direction 🤔
#redteam
To be honest, in many cases I test evasion or antivirus bypass by dropping #mimikatz onto the Desktop and running it to see if it works.
I don't use the EICAR test file 😂
Drop Mimikatz and the AV doesn't complain ==> something's worked
I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory.
Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX.
https://t.co/EevQysfANT
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.
Here's the release: https://t.co/HU2Vf8Uj6T
@7uckzero Yes, what's important is how we make a valid service "crash". If we use a custom payload to trigger it, then the failure recovery function isn't very useful anymore.
You can exploit the Service Failure Recovery feature of Windows Service to execute a payload without ever touching the ImagePath.
#antimalware#redteam#Pentesting