🧰 Windows Defender

The items that name it 43

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.technologies2026-10-29
• Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
  articleas classification.technologies2026-10-14
• Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
  writeupas classification.technologies2026-09-30
• The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
  writeupas classification.technologies2026-09-24
• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeupas classification.technologies2026-09-17
• Best Practices for Good Endpoint Hardening | Huntress
  articleas tools2026-09-10

  Endpoint antivirus/anti-malware tool; recommended with tamper protection enabled, updated virus definitions, and regular scans without risky exclusions

• Grand Theft Auto VI hype leads to malware
  writeupas tools2026-09-09

  A currently updated version can detect the malware in this ISO and stop it from compromising the system, per the article's mitigation guidance.

• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas classification.technologies2026-09-03
• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  articleas affected products2026-09-01
• Akira Hits Safe Mode: Ransomware Rebooting Around EDR
  writeupas affected products2026-08-12

  Real-time protection was disabled in Safe Mode (EID 3002, error 0x8007043c: 'This service cannot be started in Safe Mode'); later detected but failed to clean up the ransomware binary (RoutineClean failed, 0x80004005) until the host was rebooted out of Safe Mode.

• It’s Not Safe To Pay SafePa
  writeupas affected products2026-07-17

  Security product disabled/bypassed by the threat actor using LOLBin commands and GUI settings changes during SafePay incidents.

• Threat Actors Achieve Persistence After SQL Injection
  writeupas classification.technologies2026-07-13
• Defence Impairment Olympics
  writeupas classification.technologies2026-06-29
• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeupas affected products2026-06-16

  Targeted for evasion by the attacker (AMSI patching, registry policy changes like DisableAntiSpyware) during hands-on-keyboard activity; flagged and blocked some WMIExec recon.

• The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
  writeupas classification.technologies2026-06-15
• mthcht/awesome-lists
  repoas classification.technologies2026-06-10
• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeupas classification.technologies2026-06-03
• Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
  writeupas classification.technologies2026-06-02
• Inside Microsoft Defender's Signature World
  writeupas classification.technologies2026-05-22
• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas classification.technologies2026-05-21
• Threat Actor Defense Evasion: How Attackers Disable AV & EDR
  writeupas classification.technologies2026-05-18
• 0xhackerfren/ProcMon-MCP
  repoas classification.technologies2026-05-07
• 0xMohammedHassan/morphkatz
  repoas classification.technologies2026-05-07
• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas classification.technologies2026-04-30
• Nightmare-Eclipse Tooling Seen in Real-World Intrusion
  writeupas affected products2026-04-20

  Target of BlueHammer, RedSun, and UnDefend privilege escalation/evasion techniques abusing its scanning, Volume Shadow Copy remediation, Cloud Files sync root handling, and signature update pipeline.

• Attackers Love Your VPN To-Do List
  articleas classification.technologies2026-04-17
• When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk
  writeupas affected products2026-04-14

  Built-in Windows AV given exclusions for staging directories (DGoogle, EMicrosoft, DDapps) via an embedded script

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeupas classification.technologies2026-03-12
• Trust Me, I’m a Shortcut
  writeupas tools2026-02-12

  Defensive software noted to detect out-of-the-box the long-known whitespace-padding variant of command-line argument hiding (related to CVE-2025-9491).

• Employee Monitoring and SimpleHelp Software Abused in | Huntress
  writeupas affected products2026-02-11

  Security software targeted for tampering via Windows registry modification in Case #1.

• Local administrator account remote logon in Windows
  writeupas classification.technologies2026-01-31
• Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
  writeupas affected products2025-12-22

  Security tool targeted for exclusions/disabling and that detected/quarantined malware in the incidents.

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas classification.technologies2025-12-03
• Oh my .. ! - Suspicious network traffic detected including Ransomware
  writeupas classification.technologies2025-01-22
• EDR: The Great Escape - RomHack Training Review
  writeupas affected products2024-09-30It is written here as Windows Defender (WdFilter).

  Real-time scanner minifilter driver discussed as example of high-altitude filter driver in altitude sickness bug class

• ScriptBlock Smuggling
  writeupas tools2024-09-13

  Antivirus product that detects the ScriptBlock Smuggling PoC code as Trojan:PowerShell/ScriptSmug.A

• Avred background: Advances in Reversing Defender Signature Format
  articleas affected products2024-06-30

  signature database and WdFilter.sys kernel-space minifilter driver component, responsible for scanning files

• Canarytokens: Catching Insider Threats (and Threat Actors?)
  writeupas tools2024-05-06

  Local antivirus that flagged the Invoke-EnvBypass code as malicious during testing

• N-IOCs to Rule Them All
  writeupas affected products2023-12-31

  malware sets scan exclusions via HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths, logged as event ID 5007

• CVE-2023-36631: Circumventing Windows Firewall controls with... Malwarebytes' Windows Firewall Control
  writeupas classification.technologies2023-06-21
• Using a C# Shellcode Runner and ConfuserEx to Bypass UAC
  writeupas classification.technologies2020-10-30
• Sigma r2026-07-01 — 20 new detection rules
  repoas tools

  Antivirus/EDR; new rule detects disabling via SystemSettingsAdminFlows.EXE

• DEF CON® 34 Hacking Conference - Main Stage Talks
  otheras classification.technologies