Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

detects Windows exceutables potentially bypassing UAC using eventvwr.exe