Analysis of AV Process Injection and Evasion Techniques with POC

Vulnerability Summary Overview This webpage discusses process injection and antivirus bypass techniques targeting domestic antivirus software (such as Kafan, Rising, Avast, McAfee, Microsoft Defender, etc.). By crafting malicious samples (FakeApp/CW), specific code logic is used to forcibly terminate antivirus processes, thereby bypassing their monitoring and detection mechanisms. Impact Scope Affected antivirus software includes: - Rising - Avast - McAfee - Microsoft Defender - Other domestic antivirus products (e.g., “Coffee Blacklist,” “SESC” mentioned by Kafan forum users) Attack method: Directly terminating antivirus processes by calling Windows APIs such as , . Exploitation conditions: Requires local privileges, and the target antivirus must not have kernel-level protection or driver-based defense enabled. Remediation Measures 1. Upgrade antivirus to the latest version and enable kernel-level protection (e.g., EDR, driver-layer monitoring). 2. Disable high-risk API calls: Restrict access to sensitive APIs such as , via system policies. 3. Strengthen process integrity checks: Antivirus should monitor whether its own processes are terminated illegally and automatically restart or alert. 4. User behavior control: Prohibit non-administrator users from executing suspicious programs and restrict script permissions. POC Code (from original post) > Note: This code snippet is pseudocode extracted through reverse engineering; actual exploitation requires adjustments based on specific antivirus process names and memory layout.

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of AV Process Injection and Evasion Techniques with POC