Video wird geladen...
Video konnte nicht geladen werden
Fancy Defender evasion? Yet another method, nearly bare hands: 1. Export CurrentControlSet to a file 2. Edit path in a file 3. Import a file as new ControlSet 4. Change "Select" values to new one 5. Reboot 6. Enjoy 😎 A side effect of my "Registry internals" session yesterday 😅
74,089 Aufrufe • vor 3 Jahren •via X (Twitter)
11 Kommentare
BTW if you think about responsible disclosure, the answer is quite simple: @msftsecresponse closes immediately reports related to Defender if you do not provide "Short explanation on how an attacker could use the information to exploit another user remotely".
You can get around pretty much all AVs this way. Addressing it would be super expensive performance wise. There’s really no good way to stop admins from doing nasty things.
One RegNotifyChangeKeyValue() watching the Select key.
is that method work only on admin account or non-priveleged also?
Admin only, due to two reasons: 1. RegSaveKey() / RegRestoreKey() restrictions, 2. Permissions on HKLM\SYSTEM and HKLM\SYSTEM\Select
@UK_Daniel_Card really cool!
could we run our own program instead? e.g. nsmpeng.exe ? snd would that have additional benefits?
Sure. You can add your own service after restoring the key. Or just edit paths in the binary file. Whatever is easier for you.
Lol nice
@Sug4r7 this is awesome! I also have similar research in this persistence topic and I’m planning to release it later this aug.but I might release it soon because of this great research! 😊👍
@Sug4r7 And what about publishing your research in parts? :)
![Here's how I'm running automated content engine in 2 files 1 markdown file = my wiki 1 html file = my dashboard that's the whole stack. [ the architecture, in plain words ]: LLM wiki = a single markdown file holding my audience DNA, 15 tracked creators, every viral topic from the last 30 days HTML artifact = a single page that reads that markdown file AND can trigger my agents the artifact and the agent talk to each other directly the wiki is the shared brain [ what I actually see when I open it at 9am ]: > 5 trending topics ranked by my audience-DNA fit > 3 KOL posts worth quoting today > last week's saved tweets (so I can ride waves that are still warm) > buttons: [draft tweet] [draft QT] [schedule] [log idea] 1. I click "draft tweet" on a topic 2. the artifact pings my agent 3. agent reads the wiki, drafts in MY voice, returns it to the artifact 4. I edit, schedule, done 15 minutes from morning coffee to 3 scheduled posts [ how to build the same in one evening ]: > step 1: dump your domain knowledge into ONE markdown file (audience profile, KOL list, content rules, voice guide, anything an agent would need to do YOUR job) > step 2: ask claude to build an html artifact that reads from that file ("here's my wiki, build me a dashboard with these views") > step 3: add buttons for the actions you do daily (draft, schedule, log, score, search — your workflow, not mine) > step 4: wire each button to call your agent via tool calls (so the artifact and the agent talk directly) the moment your artifact reads your wiki AND triggers your agents.. most SaaS tools you currently pay for quietly become unnecessary dashboards I used to pay $50/month for now sit in a single html file I can rebuild in 20 minutes every "I'll build a SaaS for this" idea you had last year is a 200-line file you write in an afternoon if you want to get the same content engine, just reply "CONTENT" and will send you in DMs later we're going from buying software to owning it.](https://image.24vids.com/tw-2053069887266771190/amplify_video_thumb/2053069374546710532/img/hxdHKnJf0ezvg9S_.jpg)