Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detects Umbral payload

Family: Umbral

Umbral stealer is an open-source modular stealer written in C#.

Detects command variations typically used by ransomware

Detects executables attemping to enumerate video devices using WMI

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables containing possible sandbox analysis VM names

Detects executables containing possible sandbox analysis VM usernames

Detects executables containing possible sandbox system UUIDs

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables using Telegram Chat Bot

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.