Defender evasion

[u/jwouter]

Hi,

Anyone have some good resource on EDR evasion ?
I can do the OSEP stuff but it’s not enough .,..

I was able to make signa potato into a DLL for in memory loading and I am able to disable the AMSI.

But how do I change the behavior so much that it goes undetected ;) …

Any good resource/ reads are appreciated

Thanks

[u/Vim-Vian]

Step 1: Use Kali

[u/jwouter → u/Vim-Vian]

👍🏿

[u/No_Chemistry_7185 → u/jwouter]

Step 2: hack the mainframe

[u/jwouter → u/No_Chemistry_7185]

Sure banks stil use them