> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/antivirus-evasion-defender/defender-module-for-powershell.md). # Defender Module for PowerShell ```powershell-session PS C:\> Get-Command -Module Defender CommandType Name Version Source ----------- ---- ------- ------ Function Add-MpPreference 1.0 Defender Function Get-MpComputerStatus 1.0 Defender Function Get-MpPreference 1.0 Defender Function Get-MpThreat 1.0 Defender Function Get-MpThreatCatalog 1.0 Defender Function Get-MpThreatDetection 1.0 Defender Function Remove-MpPreference 1.0 Defender Function Remove-MpThreat 1.0 Defender Function Set-MpPreference 1.0 Defender Function Start-MpScan 1.0 Defender Function Start-MpWDOScan 1.0 Defender Function Update-MpSignature 1.0 Defender ``` Status: ```powershell-session PS C:\> Get-MpComputerStatus AntivirusSignatureLastUpdated : 4/8/2024 3:02:58 PM IsTamperProtected : False IsVirtualMachine : True RealTimeProtectionEnabled : True ``` [Get-MpThreat](https://learn.microsoft.com/en-us/powershell/module/defender/get-mpthreat) can be used to view the history of threats detected on the computer ```powershell-session PS C:\> Get-MpThreat CategoryID : 6 DidThreatExecute : False IsActive : False Resources : RollupStatus : 1 SchemaVersion : 1.0.0.0 SeverityID : 5 ThreatID : 2147894794 ThreatName : Backdoor:Win64/CobaltStrike!pz TypeID : 0 PSComputerName : ``` [Get-MpThreatDetection](https://learn.microsoft.com/en-us/powershell/module/defender/get-mpthreatdetection): allows users to view the threat detection history on a computer. We could specify the `ThreatID` as an additonal parameter ```powershell-session PS C:\> Get-MpThreatDetection -ThreatID 2147894794 ActionSuccess : True AdditionalActionsBitMask : 0 AMProductVersion : 4.18.24020.7 CleaningActionID : 2 CurrentThreatExecutionStatusID : 1 DetectionID : {BD0541EE-FDE0-4001-9BEF-13CEA41FC7DE} DetectionSourceTypeID : 3 DomainUser : WIN-I092S2V54F8\Administrator InitialDetectionTime : 4/9/2024 9:38:39 AM LastThreatStatusChangeTime : 4/9/2024 9:38:55 AM ProcessName : C:\Windows\explorer.exe RemediationTime : 4/9/2024 9:38:55 AM Resources : {file:_C:\artifact_x64.exe} ThreatID : 2147894794 ThreatStatusErrorCode : 0 ThreatStatusID : 3 PSComputerName ``` [Get-MpPreference](https://learn.microsoft.com/en-us/powershell/module/defender/get-mppreference) and [Set-MpPreference](https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference) may be used to configure `Defender` - `enable/disable real-time protection` to avoid files getting deleted ```powershell-session PS C:\> Set-MpPreference -DisableRealTimeMonitoring $true ``` {% content-ref url="/pages/3H9JTtBNJqIsmdr4TW9A" %} [Disable / Remove AV Defender and Firewall](/0xss0rz/pentest/internal-pentest/disable-remove-av-defender-and-firewall.md) {% endcontent-ref %} ### Interesting Books {% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %} [Interesting Books](/0xss0rz/interesting-books.md) {% endcontent-ref %} {% hint style="info" %} **Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you. {% endhint %} * [**Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems**](https://www.amazon.fr/dp/1718503342?tag=0xss0rz-21) The author uses his years of experience as a red team operator to investigate each of the most common sensor components, discussing their purpose, explaining their implementation, and showing the ways they collect various data points from the Microsoft operating system. In addition to covering the theory behind designing an effective EDR, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.