Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures
Dive into the intricacies of Windows Defender's undocumented signature format in this 39-minute Black Hat conference talk. Explore the inner workings of Windows' built-in antivirus software, focusing on Attack Surface Reduction (ASR) and its implementation. Learn about Windows Defender internals, signature modules, and update mechanisms. Discover techniques for signature evasion and bypassing ASR rules, valuable for security auditors and penetration testers. Gain insights into LUA scripts, DBVAR signatures, and the peculiarities of Windows Defender's update process. Presented by Camille Mougey, this talk demystifies Windows Defender's complex architecture and provides practical knowledge for both defensive and offensive security professionals.