Bypass Record
Obfuscation / Packing × Microsoft Defender Antivirus
A publicly-reported instance of Obfuscation / Packing bypassing Microsoft Defender Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The SharpC2 drone.dll is obfuscated using ConfuserEx2 with rename-only obfuscation, while classes using .NET Reflection are excluded to maintain functionality. The obfuscated DLL is then embedded into the final executable. This reduces entropy and avoids static signatures (BluntC2, Wacatac ML) that previously triggered on the unobfuscated payload.
Detection & mitigation
Monitor for .NET assemblies with high entropy or obfuscation characteristics (e.g., ConfuserEx artifacts). Implement behavior-based detection focusing on reflective loading, C2 communication patterns, and anomalous process behavior. Ensure Defender's cloud-delivered protection and behavior monitoring are enabled.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.