{"id":598,"date":"2025-02-13T20:42:58","date_gmt":"2025-02-13T20:42:58","guid":{"rendered":"http:\/\/thetrueartist.co.uk\/?p=598"},"modified":"2025-02-24T13:42:44","modified_gmt":"2025-02-24T13:42:44","slug":"a-simple-yet-effective-windows-defender-bypass-other-av-engines-too","status":"publish","type":"post","link":"http:\/\/thetrueartist.co.uk\/index.php\/2025\/02\/13\/a-simple-yet-effective-windows-defender-bypass-other-av-engines-too\/","title":{"rendered":"A Simple Yet Effective Windows Defender Bypass (Other AV Engines Too!)"},"content":{"rendered":"\n

Recently when researching different tactics threat actors use to bypass AV (Anti-Virus) engines I discovered this very simple yet effective “bypass”.<\/p>\n\n\n\n

<\/div>\n\n\n\n

After learning how to build a relatively basic C++ ransomware I was wondering which techniques are likely to succeed in bypassing anti viruses.<\/p>\n\n\n\n

\"\"
library prep snippet before XOR encoding strings & dynamic API allocation\/obfuscation<\/figcaption><\/figure>\n\n\n\n
<\/div>\n\n\n\n

After building out tools like the usual XOR string encoders, dynamic API allocation at runtime and sandbox detection etc for the ransomware … I was wondering if there is a way to completely get around anti virus engines noticing that the users files are being encrypted.<\/p>\n\n\n\n

\"\"
library prep snippet with XOR encoding strings & dynamic API allocation\/obfuscation<\/figcaption><\/figure>\n\n\n\n

The issue with bypassing AVs with ransomware is that even if you get around static detection, or even dynamic detection for a while, a decent AV or EDR solution should always spot that the users files are being encrypted and renamed at light speed. While many AV Engines that I have tested crumble alone with simple XOR encoding and dynamic API calls, many are decent enough to catch them encrypting files at runtime, or even when AP.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Bypassing Defender<\/h2>\n\n\n\n

To successfully bypass Defender and other AVs I discovered a technique that completely evades modern engines.<\/p>\n\n\n\n

It exploits safemode to do this. <\/p>\n\n\n\n

<\/div>\n\n\n\n

What is safemode?<\/h3>\n\n\n\n

Safemode is a diagnostic tool that only loads critical drivers and services that run Windows. It is normally used to help troubleshoot issues by running the system with minimal functionality, in an attempt to make it easier to troubleshoot problems with software, drivers or, ironically, even malware.<\/p>\n\n\n\n

<\/p>\n\n\n\n

With safemode in its most minimal of configurations Microsoft Defender or similar AVs\/EDRs will not run.<\/p>\n\n\n\n

<\/p>\n\n\n\n

With this idea I was set on making a packer that could exploit this vulnerability.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Custom Packer<\/h2>\n\n\n\n

This packer that exploits safemode is mostly like any other, it encrypts the executable file until detonation. However where this one differs is in its stages and how it unpacks, as well how it uses safemode.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Upon detonating it elevates itself to admin before saving itself to C:\\Windows\\System32\\smploader.exe, it sets itself to execute at user logon with a Userinit registry key, as well as registering it as a service that runs in safemode.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n


It then checks to see if the machine is in safemode using different environment variables and registry keys, both at initial runtime and after reboot.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

If it is not in safemode it attempts to restart into minimal safemode and sets the smploader.exe to run once with the –safemode parameter.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

It has protections so that it isnt in a perma boot-loop.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

To attempt to look realistic it uses the winAPI “InitiateSystemShutdownExA” with a custom message:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

From there it reboots into minimal safemode, it then automatically launches (in this case) from C:\\Windows\\System32\\smploader.exe –safemode.<\/p>\n\n\n\n

<\/div>\n\n\n\n

It then verifies that it is in safemode before unpacking.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

From there it can basically do anything, as there is no AV\/EDR, and you do not even need UAC permission to execute binaries as admin.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Application for Ransomware\/Malware<\/h2>\n\n\n\n

With this being said, this bypass is pretty perfect for ransomware, as there is no threat of AV’s being able to stop it once it has been unpacked in safemode. With even Microsoft Defender implementing “Controlled folder access” it is getting harder to successfully execute ransomware, with this bypass as long as the packer is properly obfuscated and it is not detected before it reboots into safemode, then the ransomware payload has a 100% chance of working with Windows systems supporting safemode.<\/p>\n\n\n\n

<\/div>\n\n\n\n

There are some small caveats:<\/strong><\/p>\n\n\n\n

    \n
  • You need to elevate to admin after runtime<\/li>\n\n\n\n
  • For a “real” threat actor’s ransomware you would need to get the private and public keys for encryption\/decryption before unpacking in safemode<\/li>\n\n\n\n
  • And for other types of malware (infostealers for example) that need internet access, you would need to have your internet enabled features either before or after entering minimal safemode <\/li>\n<\/ul>\n\n\n\n

    These caveats are quite minor in my opinion, especially for infostealers, as after unpacking you could easily write exclusions for your binaries in safemode, gather credentials, then when rebooting into windows normally you could easily exfiltrate credentials. For ransomware it is a bit more complicated with the encryption and decryption keys, but it is still very doable.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Showcase<\/h2>\n\n\n\n

    This is a showcase of the bypass working, it is in a time lapse in parts as I have implemented extremely long sleeps between stages of its execution:<\/p>\n\n\n\n

    \n