Bypass Record
Disable or Modify Tools × Microsoft Defender Antivirus
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Defender Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
CRUDEEXCLUDE uses PowerShell commands to disable Microsoft Defender's real-time monitoring and tamper protection, then drops and executes HEAVYGRAM. HEAVYGRAM is a backdoor that communicates with a C2 server, supports keylogging, file upload/download, and command execution, and uses process injection to evade detection.
Detection & mitigation
Monitor for suspicious PowerShell commands attempting to disable Defender (e.g., Set-MpPreference -DisableRealtimeMonitoring $true) and unexpected changes to Defender settings. Deploy endpoint detection and response (EDR) with tamper protection enabled, and restrict local admin privileges to prevent unauthorized modifications.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.