Loading story…
Two separate Windows-focused research writeups describe practical evasion techniques against Microsoft Defender/EDR. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., Invoke-Mimikatz) at runtime using PowerShell character encoding/concatenation ([char]NN), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled.
A second report covers EDRStartupHinder, a newly released tool by researcher TwoSevenOneT that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and Bindlink redirection of a selected System32 DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., MsMpEng.exe, running as PPL) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in KnownDLLs and identifying service group order via HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder and tooling like Process Monitor/Process Explorer boot logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A researcher published testing results claiming Windows Defender could be bypassed by constructing malicious strings such as "Invoke-Mimikatz" through PowerShell character-code encoding, avoiding signature-based detection. The same testing said more explicit AMSI tampering attempts were blocked, while other suspicious behaviors like RWX memory allocation were not detected or prevented.
Security researcher TwoSevenOneT released EDRStartupHinder, a tool that uses Windows Bindlink to prevent antivirus and EDR services from starting by redirecting critical System32 DLLs. The technique was demonstrated against Microsoft Defender on Windows 11 25H2 and relies on causing protected security processes to fail during startup.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers disclosed **RoguePlanet** and **RedSun**, two Windows local privilege escalation exploits that abuse Microsoft Defender workflows to elevate a standard user to `NT AUTHORITY\SYSTEM` on fully patched Windows systems. RoguePlanet weaponizes Defender’s quarantine pipeline through a design-level race condition involving **NTFS junctions**, **opportunistic locks**, **Volume Shadow Copy**, and the Windows Error Reporting `QueueReporting` scheduled task, while RedSun abuses Defender’s SYSTEM-privileged real-time scanning path with **Cloud Files API placeholders**, batch oplocks, and junctions to redirect privileged writes into `C:\Windows\System32`. Reports said the techniques rely on architectural interactions among legitimate Windows components rather than memory corruption or kernel bugs, making them harder to address with traditional exploit mitigations. RoguePlanet was publicly released by a researcher linked to the **Nightmare-Eclipse** toolset and was reproduced on Windows 11, with one report saying it had no patch or CVE at disclosure and another identifying it as **`CVE-2026-50656`** and stating it was already under active exploitation on Windows 10 and 11. Microsoft Defender reportedly detects a specific RoguePlanet sample as `Exploit:Win32/DfndrRugPlnt.BB`, but researchers said the exploit can remain effective after minor source changes and may succeed reliably on some hardware. RedSun was described as part of a broader offensive toolkit with **BlueHammer** and **UnDefend**; BlueHammer was patched as **`CVE-2026-33825`**, while RedSun and UnDefend were reported as unpatched and active, prompting recommendations to monitor `MsMpEng.exe`, restrict local access, and reduce SMB exposure until fixes are available.
Jul 12, 2026
Security researchers have highlighted advanced methods for analyzing and manipulating Windows binaries, focusing on both dynamic binary instrumentation (DBI) and DLL hijacking techniques. The use of open-source frameworks like DynamoRIO enables analysts to perform runtime analysis, reverse engineering, and security auditing of executables without access to source code. These tools are essential for malware analysis and can evade anti-analysis techniques, providing transparency and low performance impact during execution. Step-by-step guides and sample code are available to help researchers build their own DBI tools for Windows 11, demonstrating practical applications in security research. In parallel, researchers have explored persistence and privilege escalation techniques involving DLL hijacking in Windows accessibility features. By exploiting the way Narrator.exe loads specific DLLs, attackers with local administrator access can execute arbitrary code by placing malicious DLLs in targeted directories. This method, which has persisted despite being known for over a decade, allows code execution within the context of system processes, although it may require additional steps to suppress unwanted side effects such as the accessibility feature's voice output. These findings underscore the ongoing need for vigilance in monitoring both binary instrumentation and DLL loading behaviors on Windows systems.
Jun 29, 2026
Praetorian publicly released **Swarmer**, a Windows persistence tool that enables **low-privilege** attackers to establish startup execution while **evading EDR visibility** by avoiding standard registry-write APIs. The technique abuses **mandatory user profiles** by creating a `NTUSER.MAN` hive (derived from `NTUSER.DAT`) that overrides the normal per-user registry hive at next logon; because the modified hive is not loaded until the user signs in again, EDR products that rely on monitoring live registry modifications (e.g., hooks on `RegSetValue*` and related telemetry) may not observe the persistence being set. Swarmer achieves this by using Microsoft’s **Offline Registry Library** (`offreg.dll`) to build and modify registry hives “offline” (e.g., via functions such as `OROpenHive`, `ORCreateKey`, `ORSetValue`, and `ORSaveHive`) rather than calling the typical `Reg*` APIs that many EDRs instrument. Reported operator workflow includes exporting `HKCU`, adding a startup entry (commonly under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`), generating a modified `NTUSER.MAN`, and placing it in `%USERPROFILE%` so the persistence activates on the next login; the Reddit post links to the same research/tool release and reiterates the core evasion premise (no observable registry writes at the time persistence is staged).
Jun 29, 2026