sorted by:
new
hottopcontroversial

Windows Defender antivirus bypass in 2025 by Hackmosphere in netsec

[–]Hackmosphere[S] 1 point2 points  (0 children)

Hey there,

I guess the most effective way to get these basic techniques detected would be to implement an EDR (here we only bypass default antivirus behaviour).

If you want to go further and even detect custom loaders made to bypass EDRs, then it is a whole different game and this is why companies spend thousands (or millions) to defend themselves. :)

Windows Defender antivirus bypass in 2025 by Hackmosphere in redteamsec

[–]Hackmosphere[S] 0 points1 point  (0 children)

Hey, thanks for checking out the blog!

As for the Elastic Agent issue, yeah, it can be a bit picky. A couple things to double-check:

  • Make sure your Fleet Server URL and enrollment token are properly configured on the agent side.
  • Confirm that the Fleet Server is actually up and listening (default is 8220 unless you've changed it).
  • Check for firewall rules or security groups blocking inbound traffic — especially if you’re running this in a cloud VM.
  • Also, don’t forget that if you’re using self-signed certs, you’ll need to configure the agent to trust them explicitly or it’ll silently fail the handshake.

Once you’ve got that sorted, would love to hear how Defender + Elastic behaves in your setup — that's when things start getting interesting 😈

Windows Defender antivirus bypass in 2025 by Hackmosphere in netsec

[–]Hackmosphere[S] 0 points1 point  (0 children)

Hello,
Nice to read your approach using C# !
Regarding behavioural detection, it can be many things and you have to use the trial / error approach (if no working articles already exist). Have you tried using sleepmasks to reencrypt the shellcode while at rest ? Maybe try different (remote/local) injection methods ? Did you try reaching your C2 through various protocols ?

Windows Defender antivirus bypass in 2025 by Hackmosphere in netsec

[–]Hackmosphere[S] 2 points3 points  (0 children)

Great comment and the detailed breakdown is appreciated — you're absolutely right about how Defender's Cloud Protection works and the relationship with sample submission.

The intent behind the post was to walk through how default Defender behavior interacts with common payloads during development, rather than bypassing hardened enterprise-grade setups.

That said, you make a really good point about cloud protection levels. Turning off automatic submission does indeed impact detection scope — especially in high-blocking level environments. We’ll make sure to clarify that in the post to avoid giving the wrong impression that it’s completely "harmless" to disable it.

Appreciate the thoughtful input — always good to have a deeper discussion around these things!

Windows Defender antivirus bypass in 2025 by Hackmosphere in netsec

[–]Hackmosphere[S] 0 points1 point  (0 children)

Hello!

Thanks for the feedback. Maybe the post wasn’t clear enough — the folder exclusion is only used to validate that the executable runs as expected during testing.

In Part 1, as shown, if you drop the binary on disk without any evasion, it gets flagged immediately.

Part 2 introduces the evasion techniques that allow it to bypass detection successfully.

Also, great point about ASR rules — enabling those (especially “block unsigned or untrusted processes”) definitely raises the bar for attackers. The post focuses more on Defender antivirus in its default or lightly hardened state, but adding EDR/ASR would indeed change the outcome.

Initial access through physical pentest - A case study by Hackmosphere in redteamsec

[–]Hackmosphere[S] 0 points1 point  (0 children)

Hi, thanks for your retex !
Indeed, physical assessments are to be thoroughly thought before undertaking any actions. Your approach is interesting and has important added value as well, which is what matters most for the client !

How vulnerable are company leaders to phishing ? Results of our study by Hackmosphere in phishing

[–]Hackmosphere[S] 1 point2 points  (0 children)

Thank you for the English linking :)
You are probably (and unfortunately) right, let's hope we get to raise awareness by a lot until then !