Putting this here in News because I’m not sure this technique is fully viable or being actively used, but it’s still interesting. This article details now you use the Windows Security Center API to register a bogus new antivirus product, shifting Defender into passive mode. The article explains the mechanism and contains detection opportunities.
