App Review Microsoft Defender's challenge.

[Andy Ful]

Andy,

I don't suppose you could provide a basic flowchart of this bypass, without of course revealing details on how it works?

That's right. My videos intend to show that generally the AV protection can be bypassed, assuming that the attacker has already got high privileges.
My intention was not to focus on explaining how to do it and what can happen next.
Of course, "what can happen next" must also be discussed to understand why one should focus on how to prevent it.
At home, "what can happen next" is a minor problem compared to "how to prevent malware, especially the elevated one".

Edit.
In Enterprises, "what can happen next" becomes an important problem. It is hardly possible to prevent security breaches.
The videos are also examples of why in an Enterprise environment, the AV should be a piece of more complex security.

 

[Trident]

In Enterprises, "what can happen next" becomes an important problem. It is hardly possible to prevent security breaches.
The videos are also examples of why in an Enterprise environment, the AV should be a piece of more complex security

More complex security such as user rights management, network segmentation, email security, encryption, IPS and others. But disabling EDR/XDR will be a huge issue as many times, it is the central point of all integrations and monitoring. Common LOLBins should definitely be blocked from executing.

 

[Practical Response]

Edit.
In Enterprises, "what can happen next" becomes an important problem. It is hardly possible to prevent security breaches.
The videos are also examples of why in an Enterprise environment, the AV should be a piece of more complex security.

To be fair in enterprise, it hinges on a few factors actually, from the company willing to allocate enough funding to the IT department to taking time down to accurately patch/secure, servers/networks and devices to controlling the devices with standard accounts and Admin oversight, to employee training on social engineering.

Most breaches happen from unpatched vulnerabilities or tricked social engineering, both of which can be minimized with proper handling.

 

[Andy Ful]

More complex security such as user rights management, network segmentation, email security, encryption, IPS and others. But disabling EDR/XDR will be a huge issue as many times, it is the central point of all integrations and monitoring. Common LOLBins should definitely be blocked from executing.

All "possible" layers should be applied. By "possible", I mean also usable in daily work.

 

[Andy Ful]

Most breaches happen from unpatched vulnerabilities or tricked social engineering, both of which can be minimized with proper handling.

The problem is that minimizing is usually not enough, for several reasons. In practice, one must assume a breach to happen and be prepared to minimize the impact of the breach.

 

[Practical Response]

The problem is that minimizing is usually not enough, for several reasons. In practice, one must assume a breach to happen and be prepared to minimize the impact of the breach.

Absolutely agree on preparations. The main problem is if determined enough as you pointed out things can still happen, regardless, a skilled breach may take effect. Off setting these are offline backups, segmented networks, intranets, many aspects of which can be deployed, but require the companies to be willing to take their security seriously. That latter part is usually the issue, the companies do not wish to allocate the necessary funds to harden a network for its business.

 

[Andy Ful]

Would be interesting to know whether DefenderUI's DefenderGuard would warn when @Andy Ful POC disables the Defender Service. When it did and it would re-enable Defender service there would be a benefit of using DUI over ConfigureDefender (@oldschool).

Re-enabling the Defender service will fail.

 

[Andy Ful]

I contacted with Microsoft via Researcher Portal:

 

[Sandbox Breaker]

I contacted with Microsoft via Researcher Portal:

View attachment 282529

Mention the big bounty! You deserve it man. Nothing is free in this world! Except your apps

I'm OFFICIALLY your #1 Fan. Just made it official.