Τεχνικές παράκαμψης Windows Defender
Windows Defender evasion techniques
View/
Keywords
Windows Defender ; Τεχνικές παράκαμψης ; AntivirusAbstract
One of the main goals of all cybercriminals is to create malicious programs that can bypass the security mechanisms of Windows systems. The most basic tool these systems use to prevent this is Windows Defender. It is a security system that comes pre-installed on computers and does not require any fee. It offers real-time protection by continuously scanning every new program that enters the machine and includes a firewall mechanism that allows the user to fully specify which actions are allowed to enter and leave their network. Despite significant improvements in recent years, it is still relatively easy to bypass. Techniques such as cryptography, sandboxing evasion, steganography, and DLL and malicious code injections into processes are some of the methods used to ensure that certain programs go unnoticed by Windows Defender. There are numerous open-source tools available for implementing these techniques, which anyone can easily select, and some of these, combined with custom code pieces, will be used in this project to test the effectiveness of Defender. Using tools like Anubis, Mythic, Africana-framework, and hoaxshell, we will test a ransomware program, a keylogger program, and programs aimed at initial access to the target machine. In conclusion, we will observe that many of the attempts tested will successfully bypass Windows Defender