Bypass Record
Disable or Modify Tools × Microsoft Defender
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The tool reverse-engineers the WSC API, which allows registered antivirus products to signal their presence to Windows, thereby disabling Defender. It leverages a signed Avast executable (wsc_proxy.exe) to interact with the WSC service and register a fake AV, effectively turning off Defender and firewall. The technique requires admin rights and persists across reboots by adding the Avast module to autorun.
Detection & mitigation
Monitor for unexpected changes to Windows Security Center registrations, such as the appearance of unknown antivirus products. Alert on the execution of wsc_proxy.exe outside of legitimate Avast installations, and enforce least-privilege access to limit admin account usage.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.