Red Team Techniques for Evading, Bypassing & Disabling MS

on YouTube ↗58m

" summary

Windows Defender ATP runs on over 2 million devices and combines host telemetry with cloud analytics; the talk demonstrates concrete evasion and disabling techniques that work in current releases. Examples include HKCU COM hijack to get persistent, signed-scriptlet execution that bypasses AMSI/ScriptBlockLogging; DLL hijacking or crashing of senseproxy and adding firewall rules to block Microsoft cloud endpoints to stop telemetry; using WMI/CIM for local-only AD recon, SPN enumeration plus silver tickets to avoid DC auth, and ephemeral golden tickets/AES keys to dodge ATA alerts.

AI-written summary · about

" chapters (23)

1. 0:00Start
2. 11:54Not Detected: Misc. Techniques to Gain Initial Foothold
3. 13:48Not Detected: WMI
4. 14:18Not Detected: Host Recon Directly Using Windows API's
5. 14:55Not Detected: Userland Persistence and AMSI Bypass via Component Object Model (COM) Hijacking
6. 20:18Protected Process Light
7. 21:15PPL Bypass
8. 24:37Remove PPL Protection, Kill Process (Privileged)
9. 28:38Advanced Threat Analytics
10. 31:45Detected: Bulk DNS queries, nslookup, zone transfers
11. 35:15Not Detected: Session Enumeration By Excluding DC's
12. 36:32Detection (ATA): Lateral Movement
13. 37:38Not Detected: SPN Enumeration & Kerberoasting
14. 39:06Not Detected: Silver Tickets
15. 40:20Detected: Modification of Sensitive Groups
16. 41:03Not Detected: Enumerating AD Access Control Entries
17. 44:54Not Detected: Lateral Movement via SQL Auth
18. 47:16Partial Detection: Copying NTDS.dit File Remotely using WMI
19. 48:02Not Detected : PSRemoting with LSASS Inject
20. 48:45Not Detected : PSRemoting with Raw Disk Access
21. 49:52Detected: Golden Tickets Detection (Using KRBTGT NTLM Hash)
22. 51:16Blue Team Takeaways
23. 54:59Red Team Takeaways

" related talks

• 39mWindows Agentless C2: (Ab)using the MDM Client StackZach Wasserman, Marcos Oviedo · Black Hat USA 2023
• 37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed VulnerabilitySergey Chubarov · Black Hat Europe 2022
• 41mSimulation Hacking, the Good, Bad and the UglyJacques van zijl · BSides Vancouver 2021
• 48m"Sneaking Past Device Guard"Philip Tsukerman · CONFidence 2019
• 36mBeing A Better Defender By Channeling Your Worst Adversary:John Stoner · 34th Annual FIRST Conference 2022
• 33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic MalwareHiroaki Toyota · FIRST Conference 2026 (FIRSTCON26)
• 39mDefender-Pretender: When Windows Defender Updates Become a Security RiskTomer Bar, Omer Attias · Black Hat USA 2023
• 52mFlying Under the Radar - New Security Evasion TechniquesEtay Maor, Tal Darsan · RSA Conference 2024