Spoofing antivirus software to disable security scanning for Windows Defender

This is not an easy task, as Windows has checks that make sure the antivirus is real, involving registry names and signature binary files. The researchers used tools such as DNSpy, Process Monitor, and manual checking to see how legitimate antivirus tools are performing when WSC registration is registered.

Es3N1N added: “Starting with my courtesy last year, I know that WSC has somehow verified the process called these APIs, and my guess is that they are verifying the signature, which is really a correct guess.”

After requesting under the DMCA of the software vendor, the early project No-defender of ES3N1N was removed from GitHub.