Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
Why Your Antivirus Might Be Taking a Coffee Break: Unmasking the No-Defender Hack
John Moutos reveals a tool that hijacks Avast’s proxy to disable Windows Defender. While this trick could soon be a favorite among threat groups, detecting it is as easy as monitoring event logs and blocking Avast’s certificate. Dive into the diary for more on defense…
Hot Take:
Who needs superheroes when you have malware that can convince Windows Defender to take a nap? This new utility is the ultimate “Sorry, not sorry” to Microsoft’s built-in antivirus!
Key Points:
- New utility disables Windows Defender by registering as the main provider through WSC proxy abuse.
- The tool exploits an Avast proxy app to access necessary WSC APIs.
- Detection possible by monitoring “SecurityCenter” Windows event log for event ID 15.
- Blocking Avast signing certificates through AppLocker can hinder the tool’s effectiveness.
- YARA rule provided for detecting Avast WSC Proxy components used by the tool.
Already a member? Log in here