Red Team,Red Teaming,Services Cyber Reading Time: 10 minutesTechnical Level: Advanced Update: This post has last been updated in June 2026 (mostly added compilation explanations but the technique still works). As pentesters, we always have to keep up to date with the latest trends and of course, bypassing antiviruses is part of our activities. In this article, we will discuss how to bypass antiviruses and since the topic is quite big, it will be divided in two separate articles: If you are already familiar with the theory behind antivirus evasion, you can directly go to the technical implementation, accessible here :https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025-part-2/. Evading antivirus detection remains a major challenge in offensive cybersecurity, particularly when dealing with Windows Defender, which is deployed by default on millions of Windows systems. In this technical article, we explore a modern bypass approach using shellcode encryption, direct syscalls and remote process injection. Key Takeaways All the code we present in this article is accessible here :https://Github.com/hackmosphere/DefenderBypass. We aim to provide several examples that should help you understanding the different steps used for bypassing antiviruses (AVs). Before diving into it, here is a brief overview of what each file does : Disclaimer This is not a tutorial to make a malicious malware, but a practical case for educational purpose only. Moreover, the code will probably not work anymore soon after it‘s disclosure. It is up to you to make it work again by adding (often minor) modifications to it (hint : threatcheck.exe should help you) 😊 Before delving into the topic of antivirus evasion, it is important to first understand some basics about Windows. The simple diagram shown below, made by Alexander Sotirov, represents the Windows program execution flow, specifically focusing on the relationship between applications, libraries (DLLs), and the Windows kernel : Here’s a breakdown of each component shown in the figure above: Antivirus (AV) & Endpoint Detection and Response (EDR) are both critical components of cybersecurity, but they serve distinct purposes. Windows Defender, like any traditional antivirus solution, primarily focuses onpreventive approach. It relies on two main pillars to detect and mitigate threats: While effective against known threats, this approach often falls short against advanced and emerging attack vectors. These solutions go beyond prevention, taking a moreproactive and investigative approach. They let programs run and continuously monitor endpoint (servers, computers…) activity, leveraging behavioral analysis at the kernel level and other advanced detection mechanisms to uncover anomalies and potential threats. Antivirus focuses on stopping threats before they get executed on the system, serving as a virtual “front door lock.” EDR assumes that breaches are inevitable, prioritizing post-compromise visibility and incident response, to minimize damage and facilitate recovery.