Warning: mkdir(): No space left on device in /var/www/tg-me/post.php on line 37

Warning: file_put_contents(aCache/aDaily/post/solidot/--): Failed to open stream: No such file or directory in /var/www/tg-me/post.php on line 50
Solidot | Telegram Webview: solidot/27104 -
Telegram Group & Telegram Channel
Defendnot 工具欺骗 Windows 禁用 Microsoft Defender

2025-05-19 15:06 by 空中城堡

杀毒软件会使用 Windows Security Center (WSC) API 通知 Windows 已安装并执行实时保护。为避免操作系统同时运行多个安全软件导致冲突,Windows 会禁用系统自带的安全软件 Microsoft Defender。研究员 es3n1n 开发了名为 Defendnot 的工具滥用了该 API,通过注册虚假的杀毒软件去禁用 Microsoft Defender。Defendnot 是基于一个已删除的项目 no-defender,no-defender 使用了第三方杀毒软件的代码去伪造 WSC 注册,在该杀毒软件开发商递交了 DMCA 删除申请后,开发者从 GitHub 下架了 no-defender。Defendnot 利用虚假的杀毒软件 DLL 规避了版权问题。WSC API 受到 Protected Process Light (PPL)、有效数字签名和其他功能的保护。Defendnot 通过将 DLL 注入到已由微软签名并信任的系统进程 Taskmgr.exe 中绕过了这些要求。

BleepingComputer:New 'Defendnot' tool tricks Windows into disabling Microsoft Defender
github.com/es3n1n/defendnot

#安全



tg-me.com/solidot/27104
Create:
Last Update:

Defendnot 工具欺骗 Windows 禁用 Microsoft Defender

2025-05-19 15:06 by 空中城堡

杀毒软件会使用 Windows Security Center (WSC) API 通知 Windows 已安装并执行实时保护。为避免操作系统同时运行多个安全软件导致冲突,Windows 会禁用系统自带的安全软件 Microsoft Defender。研究员 es3n1n 开发了名为 Defendnot 的工具滥用了该 API,通过注册虚假的杀毒软件去禁用 Microsoft Defender。Defendnot 是基于一个已删除的项目 no-defender,no-defender 使用了第三方杀毒软件的代码去伪造 WSC 注册,在该杀毒软件开发商递交了 DMCA 删除申请后,开发者从 GitHub 下架了 no-defender。Defendnot 利用虚假的杀毒软件 DLL 规避了版权问题。WSC API 受到 Protected Process Light (PPL)、有效数字签名和其他功能的保护。Defendnot 通过将 DLL 注入到已由微软签名并信任的系统进程 Taskmgr.exe 中绕过了这些要求。

BleepingComputer:New 'Defendnot' tool tricks Windows into disabling Microsoft Defender
github.com/es3n1n/defendnot

#安全

BY Solidot


Warning: Undefined variable $i in /var/www/tg-me/post.php on line 283

Share with your friend now:
tg-me.com/solidot/27104

View MORE
Open in Telegram


Solidot Telegram | DID YOU KNOW?

Date: |

Telegram announces Search Filters

With the help of the Search Filters option, users can now filter search results by type. They can do that by using the new tabs: Media, Links, Files and others. Searches can be done based on the particular time period like by typing in the date or even “Yesterday”. If users type in the name of a person, group, channel or bot, an extra filter will be applied to the searches.

In many cases, the content resembled that of the marketplaces found on the dark web, a group of hidden websites that are popular among hackers and accessed using specific anonymising software.“We have recently been witnessing a 100 per cent-plus rise in Telegram usage by cybercriminals,” said Tal Samra, cyber threat analyst at Cyberint.The rise in nefarious activity comes as users flocked to the encrypted chat app earlier this year after changes to the privacy policy of Facebook-owned rival WhatsApp prompted many to seek out alternatives.Solidot from us


Telegram Solidot
FROM USA