Process Injection × Microsoft Defender Antivirus

A proof-of-concept tool demonstrates antivirus bypass... tested against Microsoft Defender and may evade some EDRs.

Shellcode is XOR-encrypted and stored as a resource in the executable. At runtime, the executable checks if its path contains its own name (sandbox evasion), then decrypts and injects the shellcode using an unconventional method, avoiding signature-based detection.

Monitor for suspicious process injection events (e.g., Event ID 8 from Sysmon) where a process allocates memory in another process with RWX permissions and writes shellcode, especially if the source process loads encrypted resources. Mitigate by enforcing application control and blocking execution from user-writable paths.