{"id":2994,"date":"2025-04-07T22:02:49","date_gmt":"2025-04-07T22:02:49","guid":{"rendered":"https:\/\/www.hackmosphere.fr\/bypass-windows-defender-antivirus-in-2025-evasion-techniques-using-direct-syscalls-and-xor-encryption-part-2\/"},"modified":"2026-06-20T15:45:47","modified_gmt":"2026-06-20T15:45:47","slug":"bypass-windows-defender-antivirus-in-2025-evasion-techniques-using-direct-syscalls-and-xor-encryption-part-2","status":"publish","type":"post","link":"https:\/\/www.hackmosphere.fr\/en\/bypass-windows-defender-antivirus-in-2025-evasion-techniques-using-direct-syscalls-and-xor-encryption-part-2\/","title":{"rendered":"Bypassing Windows Defender Antivirus in 2026: Evasion Techniques Using Direct System Calls and XOR Encryption \u2013 Part 2"},"content":{"rendered":"\n
<\/div>\n\n

Reading Time<\/strong>: 10 minutesTechnical Level<\/strong>: Advanced<\/p>\n\n

Update: <\/strong> This post was last updated in June 2026.<\/p>\n\n

This is the second and final article on Defender evasion in 2026. In the first article (available here<\/a><\/strong>), we covered the basics needed to understand the Windows execution flow, what antivirus software is, and how it works. <\/p>\n\n

We also explained how to set up a lab so you can practice with complete peace of mind. Finally, we provided basic C++ code to execute shellcode generated using msfvenom. Obviously, this code was detected immediately. <\/p>\n\n

This second part discusses how to implement techniques to bypass static & dynamic Windows Defender detections.<\/p>\n\n

All the code we present in this article is accessible here: https: \/\/Github.com\/hackmosphere\/DefenderBypass.<\/a> We aim to provide several code examples that should help you understanding the different steps of bypassing AV. <\/p>\n\n

<\/div>\n\n

Disclaimer<\/strong><\/p>\n\n

This is not a tutorial to make a malware, but a practical case for educational purpose only.<\/p>\n\n

Furthermore, the code will likely stop working as soon as it is made public. It’s up to you to get it working again by making some (often minor) changes to it (hint: Take a look at threatcheck.exe) \ud83d\ude0a<\/p>\n\n

<\/div>\n\n

Core Principle reminders<\/h3>\n\n

Our approach relies on several pillars:<\/p>\n\n

    \n
  1. Setting up the lab<\/li>\n\n\n\n
  2. Getting a basic shellcode loader to work<\/li>\n\n\n\n
  3. Avoiding static detection<\/li>\n\n\n\n
  4. Avoiding dynamic detection by using direct syscalls (through SysWhispers2) and remote process injection<\/li>\n<\/ol>\n\n
    <\/div>\n\n

    Bypass Defender’s static detection<\/h2>\n\n

    Now that the lab is ready and the first injection done, let’s get started with evasion!<\/p>\n\n

    As mentioned above, we now want to avoid static detection, where Windows Defender looks for well-known patterns. In the code that was given in the first article, the shellcode generated by msfvenom was not encrypted. Windows Defender has therefore detected it directly, since msfvenom contains well-known IOCs (Indicator Of Compromise). <\/p>\n\n

    XOR encryption to hide shellcode<\/h3>\n\n

    XOR encryption will be used to encrypt our shellcode, making it undetectable. Some people use more advanced encryption methods, such as AES, which works well but isn\u2019t really necessary as long as the shellcode\u2019s original form is completely altered using a unique key.<\/p>\n\n

    In other terms, XOR encryption of the shellcode prevents signature detection and known pattern-based heuristics, allowing the shellcode to remain undetected when on disk (at rest, not being executed). To do this : <\/p>\n\n