🧰 Microsoft Defender Antivirus

The items that name it 11

• Tracking AI adoption in North Korean threat actor tradecraft
  articleas tools2026-10-29It is written here as Microsoft Defender Antivirus (cloud-delivered protection).

  cloud-delivered protection

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas tools2026-10-23It is written here as Microsoft Defender Antivirus: signatures for the compromised release, with real-time and cloud-delivered protection.
• Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
  writeupas affected products2026-09-30It is written here as Microsoft Defender Antivirus (MDAV).

  Windows antivirus whose exclusion feature (Path, Extension, Process, and other exclusion types) can be abused via PowerShell, WMI, GPO, or direct registry modification to bypass scanning

• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas tools2026-09-30

  Detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads.

• Phishing Abuses RMM Tools for Persistent Access
  writeupas tools2026-09-29

  Endpoint antivirus protection; cloud-delivered protection provides near-instant, automated protection against new and emerging threats.

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas tools2026-09-29

  Real-time protection, cloud-delivered protection, automatic sample submission

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas tools2026-09-28

  Cloud-delivered protection and block-at-first-sight detection of malware variants

• Inside Microsoft Defender's Signature World
  writeupas affected products2026-05-22It is written here as Microsoft Defender Antivirus (MDA).

  Modern EPP enabled by default on fresh Windows installations; the primary subject of the signature analysis.

• Threat Actor Defense Evasion: How Attackers Disable AV & EDR
  writeupas affected products2026-05-18

  targeted via firewall rule abuse and exclusion abuse (e.g., excluding C: and C:\Windows drives)

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeupas affected products2026-03-12

  Version 4.18.26010.5; Real-Time Protection disabled by threat actor (SECURITY_PRODUCT_STATE_SNOOZED)

• Deobfuscating Files for Flags: Huntress CTF 2025 Retro
  articleas affected products2025-11-06It is written here as Microsoft Defender Antivirus (MAV).

  MAV