Bypass Record
Disable or Modify Tools × Microsoft Defender
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
After compromising an IIS server, the attacker adds Microsoft Defender exclusions (likely via PowerShell or registry) to prevent Defender from scanning certain paths or processes, thereby evading detection of malicious tools or webshells. The AI-assisted playbooks automate the exploitation and post-exploitation steps, making the operation repeatable.
Detection & mitigation
Monitor for changes to Microsoft Defender exclusions via Windows Event Logs (e.g., Event ID 5007 for configuration changes) or registry modifications. Implement endpoint detection and response (EDR) rules to alert on suspicious processes modifying Defender settings, and restrict administrative privileges to limit such changes.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.