Windows?Defender功能削弱

#?關(guān)閉實(shí)時(shí)保護(hù) powershell.exe?-command?"Set-MpPreference?-DisableRealtimeMonitoring?$true"#?關(guān)閉行為監(jiān)視 powershell.exe?-command?"Set-MpPreference?-DisableBehaviorMonitoring?$true"#?禁用IOAV保護(hù)，禁止掃描下載的文件和附件 powershell.exe?-command?"Set-MpPreference?-DisableIOAVProtection?$true"#?關(guān)閉Defender自動(dòng)更新 powershell.exe?-command?"Set-MpPreference?-SignatureDisableUpdateOnStartupWithoutEngine?$true"#?禁止掃描.zip等的存檔文件 powershell.exe?-command?"Set-MpPreference?-DisableArchiveScanning?$true"#?關(guān)閉已知漏洞利用防護(hù) powershell.exe?-command?"Set-MpPreference?-DisableIntrusionPreventionSystem?$true"

Defender威脅忽視

#?禁止提交樣本 powershell.exe?-command?"Set-MpPreference?-SubmitSamplesConsent?2"#?指定用于高級(jí)威脅的自動(dòng)修復(fù)操作選項(xiàng) powershell.exe?-command?"Set-MpPreference?-HighThreatDefaultAction?6?-Force"#?指定用于中級(jí)威脅的自動(dòng)修復(fù)操作選項(xiàng) powershell.exe?-command?"Set-MpPreference?-ModerateThreatDefaultAction?6"#?指定用于低級(jí)威脅的自動(dòng)修復(fù)操作選項(xiàng) powershell.exe?-command?"Set-MpPreference?-LowThreatDefaultAction?6"#?指定用于嚴(yán)重威脅的自動(dòng)修復(fù)操作選項(xiàng) powershell.exe?-command?"Set-MpPreference?-SevereThreatDefaultAction?6"

Defender檢測(cè)擴(kuò)展排除

powershell.exe?-command?"Add-MpPreference?-ExclusionExtension?".exe""

Defender檢測(cè)進(jìn)程排除

powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"regsvr32""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"regsvr32*""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?".exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"iexplorer.exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"explorer.exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?".dll""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"*.dll""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"*.exe""

禁止向微軟報(bào)告安全信息

cmd?/c?powershell.exe?-command?"Set-MpPreference?-MAPSReporting?0"

保護(hù)關(guān)閉

#?PUA保護(hù)關(guān)閉 powershell.exe?-command?"Set-MpPreference?-PUAProtection?disable"

攻擊面減少

#?關(guān)閉受控文件夾訪問 powershell.exe?-command?"Set-MpPreference?-EnableControlledFolderAccess?Disabled"

參考資料:

攻擊技術(shù)研判｜針對(duì)Windows Defender的防御削弱及LOLBAS規(guī)避技術(shù)分析 (qq.com)

總結(jié)

以上是生活随笔為你收集整理的关闭defender的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。