+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: any RAT that can defeat/bypass/evade windows defender (/showthread.php?tid=6276950)
any RAT that can defeat/bypass/evade windows defender - electro25 - Aug 4, 2024
hi guys i am trying to exploit my 2nd system using different kind of payloads/backdoor which can give me remote code execution i have just been trying with msfvenom but windows defender catches it and deletes it when i tried to download the payload using powershell script and injecting it in ram it resulted in muli/handler to stop after sending stager message . so can someone please nudge me in the right direction how to achieve that goal .
RE: any RAT that can defeat/bypass/evade windows defender - globalroot - Aug 5, 2024
There is no malware which comes undetected by default.
You can use AMSI bypass techniques to evade defender.
RE: any RAT that can defeat/bypass/evade windows defender - DramaKing - Aug 5, 2024
(Aug 5, 2024 03:25 AM)globalroot Wrote: There is no malware which comes undetected by default.
You can use AMSI bypass techniques to evade defender.
You know of any AMSI bypass techniques that bypass Defender?
RE: any RAT that can defeat/bypass/evade windows defender - globalroot - Aug 5, 2024
(Aug 5, 2024 04:08 PM)DramaKing Wrote: You know of any AMSI bypass techniques that bypass Defender?
Yeah, the patching AmsiScanBuffer works
RE: any RAT that can defeat/bypass/evade windows defender - Byte Wizard - Aug 5, 2024
(Aug 4, 2024 09:10 PM)electro25 Wrote: hi guys i am trying to exploit my 2nd system using different kind of payloads/backdoor which can give me remote code execution i have just been trying with msfvenom but windows defender catches it and deletes it when i tried to download the payload using powershell script and injecting it in ram it resulted in muli/handler to stop after sending stager message . so can someone please nudge me in the right direction how to achieve that goal .
Metasploit is too old and widely used to bypass antivirus
You would have to heavily obfuscate/crypt the payload or write your own which I would recommend
But since it is your system just turn of Defender and enjoy your remote access