An unexpected journey into Microsoft Defender's signature World.

No ratings

Presented at REcon 2024 by

Silvio

Davide Fontana

Antonio Villani

This workshop explores adversary emulation activities, focusing on creating false flags to mimic real attacks. Using Microsoft Defender as a case study, we analyze signature formats to create samples that trigger specific detections. Participants will learn how to generate working samples which triggers specific detection gaining insights into Windows Defender's signature mechanisms.