Post #1621755
2026-04-20 06:42 UTC
@tiraniddo I guess this is what happened:
1. You created NtApiDotNet and used it in dozens of PoCs submitted to MSRC
2. Defender team was tasked with creating detection for your PoCs, and the easiest way was to detect the use of NtApiDotNet, since it was mainly used for exploitation?
Replies (1)
-
@tiraniddo@infosec.exchange 2026-04-20 18:16
@oct0xor that's what caused v1 to be detected. In v2 I tried my best to refactor it until it stopped detecting and have never used it for a PoC since. Still, something must have decided to use it, or Defender is just detecting the use of a native API which happens to be used by malware somewhere.