Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing combination of virtualization drivers

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Looks for VMWare Tools registry key