Bypass Record
Obfuscation / Packing × Microsoft Windows Defender
A publicly-reported instance of Obfuscation / Packing bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The plugin uses Zig to compile a stripped, single-threaded beacon executable that evades signature-based detection by Windows Defender. It integrates into Cobalt Strike's attack menu for quick generation.
Detection & mitigation
Monitor for newly created executables with high entropy, unusual section characteristics, or low prevalence in the environment using endpoint telemetry and static file analysis. Deploy application control policies and ensure antivirus signatures are updated to detect packed or obfuscated payloads.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.