Week of December 22, 2025

A proof-of-concept demonstrates bypassing Windows Defender by storing raw shellcode in an NTFS Alternate Data Stream (ADS) attached to a legitimate file. The loader reads and executes the shellcode from the ADS, evading static detection because Defender scans only the primary file stream. This technique reduces on-disk footprint and complicates forensic analysis.

A security researcher published a proof-of-concept bypass for the AMSI provider in Microsoft Defender for Endpoint. The technique prevents MDE's AMSI integration from scanning script content, potentially allowing malicious scripts to evade detection. This matters because AMSI is a key defense layer against script-based attacks.