While Windows Defender may appear fully operational to the casual observer, it can be covertly frozen on outdated threat signatures. The cybersecurity researcher Abdelhamid Naceri, operating under the pseudonym Nightmare Eclipse, recently released BigDiskBuster....
Full-disk encryption safeguards data only until the recovery environment emerges as a catastrophic weak link. Recently, the infamous cybersecurity researcher, Nightmare Eclipse, unveiled a novel Windows vulnerability. They dubbed this flaw GreatXML. Specifically, this...
MAPS Cloud Scanner A research tool for interacting with Windows Defender’s MAPS (Microsoft Active Protection Service) cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender’s real-time protection verdicts, sample...
The April iteration of “Patch Tuesday” has arrived with such consequence that to overlook it would be an act of profound negligence. Industry titans have collectively disseminated hundreds of remediations, with several vulnerabilities already...
Occasionally, circumventing Windows‘ security apparatus does not necessitate a direct assault on the antivirus software itself; rather, it is sufficient to orchestrate a scenario in which the software fails to initialize correctly. A security...
Akira ransomware attacks are growing ever more sophisticated: threat actors have begun exploiting a legitimate Intel CPU tuning driver to disable Windows’ built-in protections. The driver in question—rwdrv.sys, part of the ThrottleStop utility—is registered...
The Kimsuky group has once again found itself at the center of attention following a campaign that deftly combined social engineering tactics with sophisticated techniques for bypassing Windows security mechanisms. Their targets included South...
NullGate This project implements a comfortable and modern way to use the NTAPI functions using indirect syscalls, coupled with the FreshyCalls method with a little twist for dynamic syscall number retrieval. It also uses a technique...
SharpExclusionFinder This C# program finds Windows Defender folder exclusions using Windows Defender through its command-line tool (MpCmdRun.exe). The program processes directories recursively, with configurable depth and thread usage, and outputs information about exclusions and scan progress....
MDE_Enum MDE_Enum is a comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules. It is capable of querying both local and remote systems...
