matterpreter/DefenderCheck

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2623 stars · 479 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C# command-line tool that takes a binary as input and splits it iteratively to pinpoint the exact bytes that Microsoft Defender flags on. It prints the offending bytes to help identify bad code sections in tools or payloads during evasion research.

Use cases

• find which bytes in my binary Defender flags
• identify the bad code in my payload that triggers antivirus
• test if my tool gets detected by Microsoft Defender
• pinpoint signature detections in a compiled executable
• make evasion work easier by locating flagged bytes
• research antivirus signature detection on Windows

When to choose

• you develop offensive security tools or payloads and need to know exactly which bytes trigger Defender
• you are doing antivirus evasion research on a Windows machine with Defender available
• you want a simple, focused CLI utility rather than a full AV testing framework

When to avoid

• you need multi-engine antivirus testing, not just Microsoft Defender
• you are on Linux or macOS with no access to Windows Defender
• you want a fully undetected tool out of the box - Defender itself now flags DefenderCheck

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing developer-tools windows windows cli dotnet antivirus-evasion defender signature-scanning malware-research binary-analysis

Member repositories

For agents

markdown · JSON · MCP: product_card(name="matterpreter/DefenderCheck")