Skip to content

Without closing windows defender, to make defender useless by removing its token privileges and lowering the token integrity.

Notifications You must be signed in to change notification settings

zha0gongz1/weakenDefenderPriv

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

11 Commits
 
 
 
 
 
 

Repository files navigation

weakenDefenderPriv

Without closing windows defender, to make defender (and probably other AV/EDRs) useless by removing its token privileges and lowering the token integrity.

The process of technology:

  • Enable the SeDubgPrivilege in our process security token.
  • Get a handle to Defender using PROCESS_QUERY_LIMITED_INFORMATION.
  • Get a handle to the Defender token using TOKEN_ALL_ACCESS.
  • Disable all privileges in the token using SetPrivilege
  • Set the Defender token Integrity level to Untrusted.

Demo code of Golang, here is the C++ version

alt

Please refer to the principle explanation.

About

Without closing windows defender, to make defender useless by removing its token privileges and lowering the token integrity.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages