# matterpreter/DefenderCheck

Identifies the bytes that Microsoft Defender flags on.

Repository: https://github.com/matterpreter/DefenderCheck
Canonical: https://ross.abutalabs.com/products/defendercheck
Language: C#
License: BSD-3-Clause
License Family: permissive
Topics: evasion, research-tool, csharp
Last push: 2025-12-31T23:04:51+00:00

## Health v2 (maintenance only)
Score: 59/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 60, release rhythm 35, longevity 100
- inputs: {"age_days": 2703, "days_push": 245, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2623, forks 479 (observed 2026-08-28T04:07:05.190184+00:00)

## What it is
A C# command-line tool that takes a binary as input and splits it iteratively to pinpoint the exact bytes that Microsoft Defender flags on. It prints the offending bytes to help identify bad code sections in tools or payloads during evasion research.

## Use cases
- find which bytes in my binary Defender flags
- identify the bad code in my payload that triggers antivirus
- test if my tool gets detected by Microsoft Defender
- pinpoint signature detections in a compiled executable
- make evasion work easier by locating flagged bytes
- research antivirus signature detection on Windows

## When to choose
- you develop offensive security tools or payloads and need to know exactly which bytes trigger Defender
- you are doing antivirus evasion research on a Windows machine with Defender available
- you want a simple, focused CLI utility rather than a full AV testing framework

## When to avoid
- you need multi-engine antivirus testing, not just Microsoft Defender
- you are on Linux or macOS with no access to Windows Defender
- you want a fully undetected tool out of the box - Defender itself now flags DefenderCheck

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, cli
- domain: security, penetration-testing, developer-tools, windows
- platform: windows, cli, dotnet
- tags: antivirus-evasion, defender, signature-scanning, malware-research, binary-analysis

## Member repositories
- matterpreter/DefenderCheck (main) score 59

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:05.190184+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:19:58.162418+00:00, confidence not recorded.
  - readme: https://github.com/matterpreter/DefenderCheck (fetched 2026-08-28T04:07:05.190184+00:00, sha 2a312a989c86)
- Data as of 2026-08-30T08:39:29.467469+00:00.