GitPedia

DefenderCheck

Identifies the bytes that Microsoft Defender flags on.

From matterpreter·Updated June 18, 2026·View on GitHub·

**DefenderCheck** is a Identifies the bytes that Microsoft Defender flags on. The project is written primarily in C#, distributed under the BSD 3-Clause "New" or "Revised" License license, first published in 2019. It has gained significant community traction with 2,613 stars and 477 forks on GitHub. Key topics include: csharp, evasion, research-tool.

DefenderCheck

Quick tool to help make evasion work a little bit easier.

Warning: As of the 1.337.157.0 Defender signature update, DefenderCheck is classified as VirTool:MSIL/BytzChk.C!MTB. As a workaround while I work to get around this, please disable Real-time Protection in Defender before compiling DefenderCheck.

Takes a binary as input and splits it until it pinpoints that exact byte that Microsoft Defender will flag on, and then prints those offending bytes to the screen. This can be helpful when trying to identify the specific bad pieces of code in your tool/payload.

Note: Defender must be enabled on your system, but the realtime protection and automatic sample submission features should be disabled.

Contributors

Showing top 1 contributor by commit count.

matterpreter

matterpreter

35 commits

View all contributors on GitHub →

This article is auto-generated from matterpreter/DefenderCheck via the GitHub API.Last fetched: 6/23/2026