1. Excluding top-level directories is not always enough.
   


2. You have virtually no way to create exclusions without physical access.
   


3. You have as much chance of doing this as #2.
   

(May 3, 2026 02:11 PM)aerohacker Wrote:  And here we go again...

And you with these "intelligent", stupid sarcams and superficial answers... from someone who doesn't see beyond and doesn't think outside the box!

1 - That's exactly why uninstall any security solution would be ideal, whether it's AV/EDR... but even the most lay user may notice that something is missing or at one time or another he or another more experienced user needs or wants to open or run an AntiVirus scan, so adding C:\ to the exceptions, would be a less suspicious option.

2 - Have you ever used HVNC or HRDP?!

3 - Another options would be install a legitim Remote Desktop tool, just in case the server would be detected and have a way to come back or Kernel Rootkit or Bootkit, that works on same AntiVirus level or start before Operating System, to keep FUD and the server persistent.

Understand one thing, when I ask questions, it's not just to clear up doubts, because as you yourself saw, I know what to do, but it's important to keep an open mind, read, see and think about other alternatives, this is called feedback.

When someone asks things like "which Operating System, AntiVirus, RAT, Crypter or another software is better?!" or which one do you use and why?!
It is not always a matter of doubt, but wanting to know the reason, pros and cons, and deeper answers of why someone prefers to use this than that.

1. If it was as easy as uninstalling AV, AV would be worthless, blackhats would rule the interwebs, and the Internet would be too dangerous to use. Try uninstalling any AV on your own PC. AV developers make it a special kind of difficult even when you're sitting at the machine. EDR cannot be uninstalled by users. Though actually, like 15-20 years ago before AV engines were practically rootkits themselves, a broken/malfunctioning AV was a recognized sign of a virus/malware infection.
   


2. One that works? No. Thought that HVNC was for remote browser interaction. But fine, you have no way to create exclusions except physical access or gaining undetected remote access, bypassing UAC and any AV/EDR authentication, then creating exclusions to keep the FUD persistence mechanism from any future detection. Did I mention that a C:\ exclusion will immediately trigger an alert from Security Center?
   


3. Sure, that's a legitimate technique. Though if you haven't acquired the password and/or the system is behind a firewall and/or RD is unavailable, dropping AnyDesk can work, though it decreases stealth. And rootkits are rootkits. They can work. Sometimes they're rendered useless by patches.
   

(May 3, 2026 02:11 PM)aerohacker Wrote:  And here we go again...

And you with these "intelligent", stupid sarcams and superficial answers... from someone who doesn't see beyond and doesn't think outside the box!

1 - That's exactly why uninstall any security solution would be ideal, whether it's AV/EDR... but even the most lay user may notice that something is missing or at one time or another he or another more experienced user needs or wants to open or run an AntiVirus scan, so adding C:\ to the exceptions, would be a less suspicious option.

2 - Have you ever used HVNC or HRDP?!

3 - Another options would be install a legitim Remote Desktop tool, just in case the server would be detected and have a way to come back or Kernel Rootkit or Bootkit, that works on same AntiVirus level or start before Operating System, to keep FUD and the server persistent.

Understand one thing, when I ask questions, it's not just to clear up doubts, because as you yourself saw, I know what to do, but it's important to keep an open mind, read, see and think about other alternatives, this is called feedback.

When someone asks things like "which Operating System, AntiVirus, RAT, Crypter or another software is better?!" or which one do you use and why?!
It is not always a matter of doubt, but wanting to know the reason, pros and cons, and deeper answers of why someone prefers to use this than that.

A rat used some similar trick to run a gotohttp install and remote the victim. Make a binded version with a startup app and you can have acces for long time and it work pc amdroid isp pie linux and you remote device via browser


And for ceypting it can crypt native payload but not support a specific rat, public stub get detected faster than private but you can make more ceypted payload. You can get avr killer so you don't really NEED crypting but it's recommanded, you can also use silent exploit to infect device easily since people won't thrust a exe But bind a silent exploit to a app used at startup and you don't let suspicious track in the folders.

(May 3, 2026 10:20 AM)DramaKing Wrote:  So you're back with another highly intelligent post.

1. Excluding top-level directories is not always enough.
   


2. You have virtually no way to create exclusions without physical access.
   


3. You have as much chance of doing this as #2.
   

(May 4, 2026 07:52 PM)Voidlight Wrote:  you can create exclusions via a uac bypass and powershell on most recent windows 11.

(May 5, 2026 08:33 AM)He B TeMy Wrote:  Guys, this discussion almost belongs in 2010/2014.
The truth is, remotely, without an exploit, you cannot bypass CURRENT Windows 11 protection that came in force early THIS year.
This includes the PUA protection, which is SEPARATE from DEFENDER and cannot be disabled via registry nor powershell (again, without exploit, which i don't know any).

It will block any "untrusted" applications from running, it does not matter if they're FUD or not, if you don't have a certificate, and a pretty good valid one, AND it's a "brand" new .exe, it will be blocked.

This puts a stick in the sand to most malware, you need physical access to turn this off.

As for AV exclusions, you can still do that with admin permissions ofcourse, but you need to disable Tamper Protection for IT to STICK (it will be applied, but Tamper will revert it, either on next reboot or next update)

So... without being superficial, read about it online about PUA, read about PowerShell Set-MpPreference like DramaKing said, and test it out yourself in a BRAND NEW VM running Windows 11.

on Windows 10 most of these will still work, but i'm talking Windows 11 here.

You speak about HVNC like it's magic stuff or whatever.

My suggestion to you is.... THINK, and start from the basics if you're old enough to have experienced anything before w10, and try to think what's the principle of it, and what ACTUALLY you want to do or not do.

There's plenty of ways still to achieve your goals, but it's getting increasingly harder day by day.

I'm not taking a shot a DramaKing, respectfully, maybe he could give you a little more advice, but the way you're writting, it's back from 2010 days with DarkComet running around.

Those "good" days will never come back. (good in quotes depending on your perspective)

Key information from this is, adapt, and test yourself on a brand new VM, fully updated, specially with April Service pack which brought and forcefully activated PUA on computers, ask me how i know.

(May 5, 2026 08:33 AM)He B TeMy Wrote:  Guys, this discussion almost belongs in 2010/2014.
The truth is, remotely, without an exploit, you cannot bypass CURRENT Windows 11 protection that came in force early THIS year.
This includes the PUA protection, which is SEPARATE from DEFENDER and cannot be disabled via registry nor powershell (again, without exploit, which i don't know any).

It will block any "untrusted" applications from running, it does not matter if they're FUD or not, if you don't have a certificate, and a pretty good valid one, AND it's a "brand" new .exe, it will be blocked.

This puts a stick in the sand to most malware, you need physical access to turn this off.

As for AV exclusions, you can still do that with admin permissions ofcourse, but you need to disable Tamper Protection for IT to STICK (it will be applied, but Tamper will revert it, either on next reboot or next update)

So... without being superficial, read about it online about PUA, read about PowerShell Set-MpPreference like DramaKing said, and test it out yourself in a BRAND NEW VM running Windows 11.

on Windows 10 most of these will still work, but i'm talking Windows 11 here.

You speak about HVNC like it's magic stuff or whatever.

My suggestion to you is.... THINK, and start from the basics if you're old enough to have experienced anything before w10, and try to think what's the principle of it, and what ACTUALLY you want to do or not do.

There's plenty of ways still to achieve your goals, but it's getting increasingly harder day by day.

I'm not taking a shot a DramaKing, respectfully, maybe he could give you a little more advice, but the way you're writting, it's back from 2010 days with DarkComet running around.

Those "good" days will never come back. (good in quotes depending on your perspective)

Key information from this is, adapt, and test yourself on a brand new VM, fully updated, specially with April Service pack which brought and forcefully activated PUA on computers, ask me how i know.

(May 5, 2026 02:01 AM)DramaKing Wrote:  Voidlight, as much as I respect you, no. Running Set-MpPreference or changing registry keys with SYSTEM privileges are not enough to override the kernel driver. Maybe it's different where you are. I can provide a screenshot later.

(May 6, 2026 05:25 PM)Voidlight Wrote:  snip

(May 5, 2026 08:39 PM)jason123 Wrote:  You are right ... I have tested something like that on two different Windows 10, The old windows without updates allowed WD to sleeping like dead while the second PC says nay! So basically those with older PCs are vulnerable while the New Windows need you to physical disable Tamper protection... The New Windows dislike this PowerShell Set-MpPreference but if any one has some tricks let us know...

(May 6, 2026 05:25 PM)Voidlight Wrote:  I have working poc on latest build of win 11 not sure why it doesnt work for you





Edit for anyone curious, this uac bypass + ghostly hollowing combo that allows you to uac bypass a payload without dropping it to disk:
- Abuse appinfo RPC DebugObject hijack to leak a PROCESS_ALL_ACCESS handle from an auto elevated fodhelper session.
- Stage the payload in a delete pending state, capture the section handle, and trigger instant NTFS wipe while the code remains in memory.
- Spawn RegAsm.exe suspended with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS spoofing to break process tree heuristics.
- NtUnmapViewOfSection the legitimate image and map the ghosted payload section into the elevated container.
- Hijack thread context and resume into the hollowed process.
- Payload resolves imports via manual PEB walking.
- Execute obfuscated PowerShell to add C:\ to defender exclusions

(May 7, 2026 07:51 PM)DramaKing Wrote:  Exactly. Thanks for echoing my point.

---

I don't care if you run obfuscated PowerShell as SYSTEM. Did you make sure that Tamper Protection was enabled? The driver will block any changes that aren't from Virus & threat protection.