Defeating Windows Defender

The course explains the approach to malware detection in the Windows environment, and the way in which the Windows Defender anti-malware software uses the anti-malware service interface (AMSI) to stop penetration testing tools being used on Windows Workstations and Servers. Instructor Malcolm Shore covers system administrator methods of switching off or removing Defender, the basic approaches used in penetration testing to avoid detection such as obfuscation and living off the land, and the various technical approaches such as memory patching and DLL hooking. At the end of the course, you should have a good working knowledge of how to defeat Windows Defender anti-malware controls.