Bypass Record
Tamper-Protection Bypass × Microsoft Defender Antivirus
A publicly-reported instance of Tamper-Protection Bypass bypassing Microsoft Defender Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The PoC uses admin privileges to obtain TrustedInstaller token, deletes the WdFilter altitude registry key, causing the minidriver to unload after reboot or wait. Then it modifies TamperProtection and Real-time Monitoring registry keys to disable Defender/MDE components.
Detection & mitigation
Monitor for deletion or modification of the WdFilter altitude registry key (HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\Instances\WdFilter Instance\Altitude) and unexpected changes to Defender tamper protection or real-time monitoring registry keys. Enforce tamper protection via Microsoft Defender for Endpoint's built-in safeguards and restrict TrustedInstaller token abuse by limiting admin privileges and monitoring for token manipulation events (e.g., Event ID 4672 with SeTakeOwnershipPrivilege).
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.