Defeating Windows Defender Obfuscating Open Source Tools

I will bypass Windows Defender in this video by obfuscating an open-source solution file and then compiling the executable. I will use invisibility cloak, defender check, and simple find and replace to show you how to get a known bad binary past Windows Defender. If you want to learn real red team bypass techniques this will show a very effective method to defeat endpoint detection and response (EDR).
Invisibility Cloak:
github.com/h4wkst3r/Invisibil...
Defender Check:
github.com/matterpreter/Defen...
Visual Studio Community Edition:
visualstudio.microsoft.com/vs...
Rubeus
github.com/GhostPack/Rubeus
FollowMe:
Twitter @BriPwn
~-~~-~~~-~~-~
Please watch: "Red Team Tips February 1st: OPSEC Safe Active Directory Enumeration with SilentHound "
• Red Team Tips February...
~-~~-~~~-~~-~

[@sul3y]

Great work man, I appreciate what you doin’ and sharing with this awesome content

[@Kingdd1os]

Thank you very much Sir, i learned with your Videos strong skills.

[@CyberAttackDefense]

Glad to hear that

[@gooniesfan7911]

Good video, do you know if once defender is bypassed that it will remain undetected until the next signature update? Or could the behavior during runtime of a binary still pop as malicious.

[@CyberAttackDefense]

Sometimes cloud detection can update these fairly quickly. It's really hard to say without an example. Once defender has been defeated move fast!

[@gooniesfan7911]

@@CyberAttackDefense Do you know if setting an ExclusionPath to the entire C:\ directory would work assuming one has physical access to the machine - or gets admin privs? Asking strictly about ExclusionPath on the entire C drive not a folder somewhere else.

[@CyberAttackDefense]

I haven’t ever tried that. I’m assuming that would work.

[@Error-33]

​@@gooniesfan7911 like he said, that probably works but ngl i'd recommend setting the malware up so that it puts itself in a folder like appdata or smthn like that. then excludes that folder from the antivirus which should 100% work
but making an exclusion path on the whole C drive could work aswell

[@cynthiaateya794]

There is no exe file for defender check in the git repo. How do I get the Defendercheck.exe?

[@CyberAttackDefense]

You have to compile it yourself from the solution file.

[@cynthiaateya794]

@@CyberAttackDefense How can I go about it?

[@CyberAttackDefense]

@@cynthiaateya794 download a recent version of visual studio code. Open the solution file like I did for rubeus and choose build as debug or release.

[@novianindy887]

so basically it only obfuscates the Strings in the exe? not the whole binary?

[@CyberAttackDefense]

This is how .Net works you can’t really obfuscate the whole binary. But EDR can only find things that are unobfuscated. When it comes to C you can use other methods like donut that make things much harder for EDR.

[@bugbounty5870]

Will these technique still works?

[@CyberAttackDefense]

Yes they require experimentation but still work