From 4bb0b1227b0a9e34b03fa2587815009c817d70a0 Mon Sep 17 00:00:00 2001 From: Nightmare-Eclipse Date: Mon, 13 Apr 2026 01:07:10 +0200 Subject: [PATCH] Update README.md --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index 9de0742..e3b99f8 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,14 @@ # UnDefend Repository hosting windows defender DOS tool + +This tool runs in two modes, passive and aggressive, + +In Passive mode, the PoC blocks all signature updates, causing defender to be unable to detect any new threats so if anything new is pushed by Microsoft, it is immediately blocked. + +![BottomText](UpdateError.png) + +In Aggressive mode, the PoC aims to completely disable but it only works if Microsoft pushes a major platform update (update of MsMpEng.exe and other binaries), this update isn't pushed occasionally like signature updates so the PoC runs in passive mode by default. However, if you expect a major platform update, set the PoC to run in aggressive mode and it will cause windows defender to stop responding. It will be completely disabled and you can run whatever you want without having defender interfer in your business. + +![BottomText](EngineUnavailable.png) + +Now funnily enough, I found a way to lie to the EDR web console to show that defender is up and running with the latest update even if it's not. I was thinking about publishing the code but after thinking about it, it will cause waaay too much damage so I think I'll keep that stuff stashed for now.