Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detects command variations typically used by ransomware

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.