Bypass Windows Defender using XOR encryption and direct system calls
Attack Techniques & Methods2026-07-01, 10:03
The author demonstrates a practical implementation of bypassing both static and dynamic detection mechanisms in Windows Defender. The main idea is to remove from the executable any artifacts that the antivirus relies on to identify malicious code: signatures of
msfvenom and calls to standard Win32 APIs. XOR encryption of the shellcode is used on disk, with decryption in memory, while API calls are replaced with direct system calls (syscalls) via the SysWhispers2 library.The first technique hinders signature-based analysis by hiding the payload during static scanning. The second removes dependency on the Import Address Table (IAT) and API monitoring of
CreateFile, VirtualAlloc, WriteProcessMemory, allowing the code to execute without detection. As a result, the attacker can evade Defender protection without privilege escalation, executing their own shellcode in the user context.Vendors
Products