Microsoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
summary
Demonstrates a concrete evasion of Microsoft Defender for Office 365: the Safe Attachments sandbox is a Windows 10 Hyper‑V template with ~1 GB RAM and one core, so a macro uses WMI macro fingerprinting (Windows build / RAM / cores) to skip execution inside that environment and run a staged payload, resulting in a reverse shell delivered to a Kali listener in live demos; Microsoft labels the behavior by design. Also shows a middle‑tier redirect bypass of Safe Links. Mitigation: add layered controls.
AI-written summary · about
chapters (7)
- 0:00Introduction and agenda
- 2:57Defender safe attachments
- 7:00Sandbox analysis
- 14:22Evasion techniques
- 21:00Advanced bypass strategies
- 30:44Safe links bypass
- 33:41Conclusion and defense
related talks
48m"Sneaking Past Device Guard"
51mSneaking Past Device Guard
42mD2T1 - Sandbox Evasion Using VBA Referencing
51mOffice in Wonderland
58mRed Team Techniques for Evading, Bypassing & Disabling MS
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
51mAdvanced VBA Macros Attack & Defence