Bypass Record
Obfuscation / Packing × Microsoft Windows Defender
A publicly-reported instance of Obfuscation / Packing bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Shellcode is encrypted with a static XOR key, embedded in a Go binary, decrypted at runtime, and executed in memory using VirtualProtect to change memory permissions. This defeats static signature-based detection because the encrypted payload does not match known malware signatures.
Detection & mitigation
Monitor for processes making suspicious VirtualProtect calls with PAGE_EXECUTE_READWRITE permissions, especially from unsigned or newly created binaries. Enable AMSI and behavioral analysis to detect in-memory shellcode execution patterns.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.