正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

Fancy Defender evasion? Yet another method, nearly bare hands: 1. Export CurrentControlSet to a file 2. Edit path in a file 3. Import a file as new ControlSet 4. Change "Select" values to new one 5. Reboot 6. Enjoy 😎 A side effect of my "Registry internals" session yesterday 😅

Grzegorz Tworek

38,132 subscribers

74,059 次观看 • 2 年前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

11 条评论

Grzegorz Tworek 的头像

Grzegorz Tworek2 年前

BTW if you think about responsible disclosure, the answer is quite simple: @msftsecresponse closes immediately reports related to Defender if you do not provide "Short explanation on how an attacker could use the information to exploit another user remotely".

imag0r 的头像

imag0r2 年前

You can get around pretty much all AVs this way. Addressing it would be super expensive performance wise. There’s really no good way to stop admins from doing nasty things.

Grzegorz Tworek 的头像

Grzegorz Tworek2 年前

One RegNotifyChangeKeyValue() watching the Select key.

Daniel Mielczarek 的头像

Daniel Mielczarek2 年前

is that method work only on admin account or non-priveleged also?

Grzegorz Tworek 的头像

Grzegorz Tworek2 年前

Admin only, due to two reasons: 1. RegSaveKey() / RegRestoreKey() restrictions, 2. Permissions on HKLM\SYSTEM and HKLM\SYSTEM\Select

Advanced Persistent Dread 的头像

Advanced Persistent Dread2 年前

@UK_Daniel_Card really cool!

Advanced Persistent Dread 的头像

Advanced Persistent Dread2 年前

could we run our own program instead? e.g. nsmpeng.exe ? snd would that have additional benefits?

Grzegorz Tworek 的头像

Grzegorz Tworek2 年前

Sure. You can add your own service after restoring the key. Or just edit paths in the binary file. Whatever is easier for you.

spencer 的头像

spencer2 年前

Lol nice

Br3akp0int 的头像

Br3akp0int2 年前

@Sug4r7 this is awesome! I also have similar research in this persistence topic and I’m planning to release it later this aug.but I might release it soon because of this great research! 😊👍

Grzegorz Tworek 的头像

Grzegorz Tworek2 年前

@Sug4r7 And what about publishing your research in parts? :)

相关视频

Pick up where you left off with chat history import. Export your data from another AI app and upload the .ZIP file to Gemini to transfer your chat history. To get started: 1) Export your data: Request a data export from your current AI provider (they will usually email you a ZIP file). 2) Upload to Gemini: Navigate to the “Import chats” section of your "Import memory to Gemini" page and select your ZIP file. 3) Pick up where you left off: Gemini securely processes and organizes your past threads so you can search, reference, and continue building on them.

Pick up where you left off with chat history import. Export your data from another AI app and upload the .ZIP file to Gemini to transfer your chat history. To get started: 1) Export your data: Request a data export from your current AI provider (they will usually email you a ZIP file). 2) Upload to Gemini: Navigate to the “Import chats” section of your "Import memory to Gemini" page and select your ZIP file. 3) Pick up where you left off: Gemini securely processes and organizes your past threads so you can search, reference, and continue building on them.

Google Gemini

45,479 次观看 • 3 个月前

A NEW METHOD OF IRRESPONSIBLE GAMBLING - First person blackjack - 5 hands at a time... but ONLY side bets A very successful session +5 figure profit 😎

Sensitive content

A NEW METHOD OF IRRESPONSIBLE GAMBLING - First person blackjack - 5 hands at a time... but ONLY side bets A very successful session +5 figure profit 😎

BTCs

35,159 次观看 • 3 个月前

SmartScreen bypassed. Mark of the Web removed. No Run Dialog. No PowerShell popup. Just a browser file upload. FileFix is a new ClickFix alternative. Browser file upload opens File Explorer. File Explorer address bar executes OS commands. cmd.exe spawns as a child of Chrome. The user thinks they are pasting a file path. Executables launched through File Explorer's address bar lose their MOTW attribute entirely. SmartScreen never triggers. Author: mr.d0x #Malware #Phishing #InfoSec

SmartScreen bypassed. Mark of the Web removed. No Run Dialog. No PowerShell popup. Just a browser file upload. FileFix is a new ClickFix alternative. Browser file upload opens File Explorer. File Explorer address bar executes OS commands. cmd.exe spawns as a child of Chrome. The user thinks they are pasting a file path. Executables launched through File Explorer's address bar lose their MOTW attribute entirely. SmartScreen never triggers. Author: mr.d0x #Malware #Phishing #InfoSec

cr3ghost

22,316 次观看 • 11 天前

Enjoy my new file~✨ This one includes a full induction designed best to be listened with headphones on~ laying down alone undisturbed~✨

Sensitive content

Enjoy my new file~✨ This one includes a full induction designed best to be listened with headphones on~ laying down alone undisturbed~✨

Fern 🌿

75,046 次观看 • 1 个月前

i couldn’t find the original file so i had to make a new one

i couldn’t find the original file so i had to make a new one

nana

202,227 次观看 • 6 个月前

So sw33tLie just blew my mind Apparently there's a ThreeJS world editor Export your world in console with: console.log(JSON.stringify(scene.toJSON())) Copy that JSON blob, save it in a file, then go to and press Import, then select that file And now you have your whole world in there! This will make it much easier for me to make the world look better 😊

So sw33tLie just blew my mind Apparently there's a ThreeJS world editor Export your world in console with: console.log(JSON.stringify(scene.toJSON())) Copy that JSON blob, save it in a file, then go to and press Import, then select that file And now you have your whole world in there! This will make it much easier for me to make the world look better 😊

@levelsio

445,712 次观看 • 1 年前

Working on a single source to single target concatenative synth that uses small chunks of one file and matches them to similar small chunks in another file. Works very fast and includes a transient mode.

Working on a single source to single target concatenative synth that uses small chunks of one file and matches them to similar small chunks in another file. Works very fast and includes a transient mode.

little-scale

19,161 次观看 • 5 个月前

I have released a new example project file! It focuses on showing my recent preferred workflow for doing head angles. Project file is included as well as roughly 3 hours of video showing my process. #Live2D Link in replies below ⬇

I have released a new example project file! It focuses on showing my recent preferred workflow for doing head angles. Project file is included as well as roughly 3 hours of video showing my process. #Live2D Link in replies below ⬇

cillia ☆

176,391 次观看 • 1 年前

How To Insert Data From A Picture In Excel: 📷 → 📊 • Take a screenshot • Insert → Data From Picture • Picture From File → Select File • Review Items For Accuracy • Add to Worksheet Done!

How To Insert Data From A Picture In Excel: 📷 → 📊 • Take a screenshot • Insert → Data From Picture • Picture From File → Select File • Review Items For Accuracy • Add to Worksheet Done!

Blake Burge

172,540 次观看 • 3 年前

With the new World of Warcraft Support A Streamer & Twitch Drop, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

With the new World of Warcraft Support A Streamer & Twitch Drop, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

MrGM

40,696 次观看 • 1 年前

What a race! 𝐆𝐚𝐞𝐥𝐢𝐜 𝐖𝐚𝐫𝐫𝐢𝐨𝐫 denies Fact To File in yet another epic John Durkan at Punchestown 👏

What a race! 𝐆𝐚𝐞𝐥𝐢𝐜 𝐖𝐚𝐫𝐫𝐢𝐨𝐫 denies Fact To File in yet another epic John Durkan at Punchestown 👏

Racing TV

383,956 次观看 • 7 个月前

New Career Path? Step 1: Marry a rich man Step 2: File false DV & 498A cases Step 3: Claim maintenance & assets Step 4: Repeat Legal extortion disguised as empowerment. Men’s safety matters too. #MensRights #FalseCases #GenderEquality #ForgottenMan

New Career Path? Step 1: Marry a rich man Step 2: File false DV & 498A cases Step 3: Claim maintenance & assets Step 4: Repeat Legal extortion disguised as empowerment. Men’s safety matters too. #MensRights #FalseCases #GenderEquality #ForgottenMan

The Forgotten ‘Man’ 👨‍⚖️

23,355 次观看 • 1 年前

With the new World of Warcraft Twitch Drop of the Beetriz Pet, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

With the new World of Warcraft Twitch Drop of the Beetriz Pet, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

MrGM

47,914 次观看 • 1 年前

New Feffrey Epstein file leaked #4 He claims the universe is a simlation.

New Feffrey Epstein file leaked #4 He claims the universe is a simlation.

Kekius Maximus

1,610,877 次观看 • 5 个月前

A simple message to the GOP: play to win. 1. Make Election Day a National Holiday 2. Single-Day Voting 3. Paper Ballots 4. Government-issued voter ID to match the voter file 5. English as the sole language that appears on a ballot

A simple message to the GOP: play to win. 1. Make Election Day a National Holiday 2. Single-Day Voting 3. Paper Ballots 4. Government-issued voter ID to match the voter file 5. English as the sole language that appears on a ballot

Vivek Ramaswamy

266,368 次观看 • 2 年前

> open Claude Code > "can I edit this file?" yes > "can I read this file?" yes > click allow 30 times per session > don't even read what you're approving > there's a file that does all of this automatically > it's called settings.json > takes 2 minutes to set up > you've been clicking allow for months

> open Claude Code > "can I edit this file?" yes > "can I read this file?" yes > click allow 30 times per session > don't even read what you're approving > there's a file that does all of this automatically > it's called settings.json > takes 2 minutes to set up > you've been clicking allow for months

darkzodchi

177,723 次观看 • 2 个月前

Enjoy my newest full length audio file~✨ I'm here to help fix you~ one at a time✨

Enjoy my newest full length audio file~✨ I'm here to help fix you~ one at a time✨

Fern 🌿

97,853 次观看 • 2 个月前

With the new World of Warcraft Twitch Drop of the Violet Sweatsuit Ensemble, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

With the new World of Warcraft Twitch Drop of the Violet Sweatsuit Ensemble, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

MrGM

41,234 次观看 • 7 个月前

With the new World of Warcraft Twitch Drop of the Shadefur Brewthief pet, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

With the new World of Warcraft Twitch Drop of the Shadefur Brewthief pet, I've created an asset for any WoW Streamer to use! 1⃣ Download the file from the link below 2⃣ Add to OBS as a "Media Source" 3⃣ Select the file 4⃣ Check the loop box 🔥 Sucess 🔗

MrGM

85,199 次观看 • 11 个月前

I don't know how to export this file as a video, so I just recorded it instead. #momoi #karin #bluearchive

I don't know how to export this file as a video, so I just recorded it instead. #momoi #karin #bluearchive

Kang Cilok's (COMMISSION OPEN)

63,146 次观看 • 1 年前