Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Detects command variations typically used by ransomware

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.