Closed phra closed 5 years ago
I second this. Manually tested my own version of this which is probably the same (pretty much followed the example) and it works. In addition, Vis with Darren Kitchen from Hak5 has a youtube video showing disabling of defender and rolling back the sigs if you have admin. I would say it being ran as a background job to monitor and whenever defender wakes up it clears it out again. I have no discovered yet what to look for to see if Defender has turned itself back on again. it is a combination of using the mpcmdrun.exe and then using powershell set-mppreference to accomplish this.
@PoSHMagiC0de i know it :smile: , my two cents:
Merged in da5fc61. I kept the random capitalization in. It doesn't make a difference if you're further obfuscating the code, but if you're not, then at least it's harder to catch with a simple signature.
fixes #1288 and #1290, supersede #1286