mattifestation/AntimalwareBlight

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell.

AV/EDR killer leveraging vulnerable kernel drivers

An even funnier way to disable windows defender (through WSC api)

DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the LOLDrivers.io database.

Polymorphic AV/AMSI bypass toolkit - Donut shellcode runner for offensive .NET/PE tools

C# AV/EDR Killer using less-known driver (BYOVD)

Activation Context Hijacking Evasion Tool

Take advantage of some more advanced Windows Defender settings.