Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables containing commands for clearing Windows Event Logs

Detects executables containing common artifacts observed in infostealers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing combination of virtualization drivers

Detects executables referencing many IR and analysis tools