Disable / Remove AV Defender and Firewall

Disable Firewall

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Disable AV Defender

Set-MpPreference -DisableIOAVProtection $true

PS C:\Users\htb-student> Set-MpPreference -DisableRealtimeMonitoring $true

Set-MpPreference -DisableRealtimeMonitoring $true -DisableScriptScanning $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true

C:>powershell Set-Mppreference -DisableRealTimeMonitoring $true

Antivirus Evasion - Defender

Tools

Windows Defender Remover

GitHub - ionuttbara/windows-defender-remover: A tool which is uses to remove Windows Defender in Windows 8.x, Windows 10 (every version) and Windows 11.GitHub

Defendnot

GitHub - es3n1n/defendnot: An even funnier way to disable windows defender. (through WSC api)GitHub

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems The author uses his years of experience as a red team operator to investigate each of the most common sensor components, discussing their purpose, explaining their implementation, and showing the ways they collect various data points from the Microsoft operating system. In addition to covering the theory behind designing an effective EDR, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.