Post #1000244
2026-04-07 20:25 UTC
Fucks sake, Defender is now signaturing on builds of my v2 version of NtObjectManager, god knows why. I fucking hate MS and Defender especially.
Replies (2)
-
@jborean@fosstodon.org 2026-04-08 07:21
@tiraniddo it is a big pain in my butt as well. I keep on getting sporadic reports around Ansible’s execution scripts being flagged by Defender/AMSI. I would like it a bit more if there was ways of trying to get the hash verified in some official process to lower the detection but alas it’s just a black box.
-
@oct0xor@mastodon.social 2026-04-20 06:42
@tiraniddo I guess this is what happened: 1. You created NtApiDotNet and used it in dozens of PoCs submitted to MSRC 2. Defender team was tasked with creating detection for your PoCs, and the easiest way was to detect the use of NtApiDotNet, since it was mainly used for exploitation?