Bypass Record
Obfuscation / Packing × Microsoft Windows Defender
A publicly-reported instance of Obfuscation / Packing bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
KGB RAT uses a crypter to obfuscate and pack its payload, evading signature-based detection by Windows Defender and other AVs. It then executes to steal credentials and provide remote control, defeating static analysis and traditional antivirus scanning.
Detection & mitigation
Monitor for suspicious process behavior such as unusual network connections, credential dumping attempts, or injection into legitimate processes. Use behavior-based detection and endpoint detection and response (EDR) to identify post-execution activities, and keep antivirus definitions updated with heuristic and machine learning capabilities.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.