Rapid7

module

Microsoft Windows Defender Evasive Executable

Disclosed
N/A

Description

This module allows you to generate a Windows EXE that evades against Microsoft
Windows Defender. Multiple techniques such as shellcode encryption, source code
obfuscation, Metasm, and anti-emulation are used to achieve this.

For best results, please try to use payloads that use a more secure channel
such as HTTPS or RC4 in order to avoid the payload network traffic getting
caught by antivirus better.
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.