Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1113866" data-attributes="member: 32260"><p>In March and April 2024, I presented a series of videos about bypassing AV solutions:</p><h3><a href="https://malwaretips.com/threads/the-comodos-challenge.129472/" target="_blank">App Review - The Comodo&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/comodos-challenge-part-2.129514/" target="_blank">App Review - Comodo&#039;s challenge part 2.</a></h3><h3><a href="https://malwaretips.com/threads/esets-challenge.129485/" target="_blank">App Review - Eset&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/microsoft-defenders-challenge.129597/" target="_blank">App Review - Microsoft Defender&#039;s challenge</a>.</h3><h3><a href="https://malwaretips.com/threads/bitdefenders-challenge.129753/" target="_blank">App Review - Bitdefender&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/the-zone-alarm-challenge.129801/" target="_blank">App Review - The Zone Alarm challenge.</a></h3><h3><a href="https://malwaretips.com/threads/the-emsisoft-enterprise-security-challenge.129862/" target="_blank">App Review - The Emsisoft Enterprise Security challenge.</a></h3><p><a href="https://malwaretips.com/threads/avasts-challenge.129933/" target="_blank"><strong><span style="font-size: 18px">App Review - Avast&#039;s challenge.</span></strong></a></p><p></p><p>I reported the attack method with all details to any interested AV vendor (Microsoft in the first place). Microsoft documented the method well a few years ago, although not for malicious actions. I discovered it when working on the WHHLight application, which uses custom WDAC policies. The attack method uses the Windows built-in security mechanism, which is why I could bypass all tested security solutions. For security reasons, I did not publish the details of the method. Now, other researchers have published the details:</p><p></p><p></p><p></p><p>[ATTACH=full]287020[/ATTACH]</p><p></p><p></p><p>Edit.</p><p>Post updated. I changed the source article and citation.</p></blockquote><p></p>

[QUOTE="Andy Ful, post: 1113866, member: 32260"] In March and April 2024, I presented a series of videos about bypassing AV solutions: [HEADING=2][URL='https://malwaretips.com/threads/the-comodos-challenge.129472/']App Review - The Comodo's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/comodos-challenge-part-2.129514/']App Review - Comodo's challenge part 2.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/esets-challenge.129485/']App Review - Eset's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/microsoft-defenders-challenge.129597/']App Review - Microsoft Defender's challenge[/URL].[/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/bitdefenders-challenge.129753/']App Review - Bitdefender's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/the-zone-alarm-challenge.129801/']App Review - The Zone Alarm challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/the-emsisoft-enterprise-security-challenge.129862/']App Review - The Emsisoft Enterprise Security challenge.[/URL][/HEADING] [URL='https://malwaretips.com/threads/avasts-challenge.129933/'][B][SIZE=5]App Review - Avast's challenge.[/SIZE][/B][/URL] I reported the attack method with all details to any interested AV vendor (Microsoft in the first place). Microsoft documented the method well a few years ago, although not for malicious actions. I discovered it when working on the WHHLight application, which uses custom WDAC policies. The attack method uses the Windows built-in security mechanism, which is why I could bypass all tested security solutions. For security reasons, I did not publish the details of the method. Now, other researchers have published the details: [ATTACH type="full" width="558px" alt="1736033682857.png"]287020[/ATTACH] Edit. Post updated. I changed the source article and citation. [/QUOTE]

Verification