Bypass Record
Obfuscation / Packing × Microsoft Windows Defender
A publicly-reported instance of Obfuscation / Packing bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The Meterpreter payload is hidden within a JPG image file using steganography. When the image is opened, it displays normally as a decoy, while the payload executes in the background, establishing a reverse TCP connection to the attacker's Metasploit handler. This evades Windows Defender's real-time, cloud-delivered, and tamper protections without requiring any exclusions.
Detection & mitigation
Monitor for unexpected network connections from image-viewing applications (e.g., Windows Photo Viewer, Paint) using process-level network telemetry (Sysmon Event ID 3) and look for anomalous child processes spawning from these applications. Mitigate by enforcing application control policies and restricting outbound connections from non-essential processes.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.