StopDefender

TrustedInstaller 및 Windefend 서비스 계정을 사용하여 새 토큰을 생성함으로써 Windows Defender를 프로그래밍 방식으로 중지합니다.

원버튼 중지 동작으로, 명령줄 옵션이나 PID를 제공할 필요가 없습니다. Post Exploitation 프레임워크와의 통합에 유용합니다.

블로그 포스트

https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/

프레젠테이션

Presentations 폴더를 확인하세요

• [Rootedcon Valencia 2022] Kill -9 Windows Defender

크레딧

• https://github.com/slyd0g/PrimaryTokenTheft
• https://posts.specterops.io/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe-80696c8a73b
• https://www.tiraniddo.dev/2017/08/the-art-of-becoming-trustedinstaller.html
• https://docs.microsoft.com/en-us/windows/win32/com/impersonation-levels
• https://halove23.blogspot.com/2021/08/executing-code-in-context-of-trusted.html
• https://docs.microsoft.com/es-es/windows/win32/api/winsvc/ns-winsvc-service_sid_info?redirectedfrom=MSDN
• https://www.alex-ionescu.com/?paged=2&cat=2
• https://github.com/rbmm/DisableSvc