'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
BigDiskBuster proof of concept keeps Microsoft Defender running while blocking updates and opening a detection gap.
Stories per day · 30 days
3 RSS
14 stories, newest first · one card per story
Stories tagged #defense-evasion
Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans
Huntress details how attackers abuse Microsoft Defender path and extension exclusions to hide malware while leaving antivirus scans appearing active.
2
Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans
Huntress warns attackers hide Microsoft Defender exclusions so malware stays unscanned and invisible to admins.
2
Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
Huntress details how attackers abuse Microsoft Defender exclusions to hide malware from scans.
9
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Huntress details phishing campaigns installing rogue ITarian and ScreenConnect RMM clients with SYSTEM persistence, amid a 277% spike in RMM abuse.
1
[object Object]
The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.
3
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without using file encryption.
2
BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates
Unverified GitHub proof-of-concept BigDiskBuster blocks Microsoft Defender platform and signature updates, potentially leaving Windows endpoints with outdated anti-malware protection.
1
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
3
Counterfeit installers turn routine software downloads into enterprise breaches
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
4
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
7
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self
Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.
1
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Huntress documents an Akira ransomware affiliate rebooting endpoints into Windows Safe Mode to evade EDR and Defender, though Safe Mode broke the ransomware.
1