https://swisskyrepo.github.io/InternalAllTheThings/redteam/evasion/windows-defenses/

• Antivirus & Detections
• Command to Disable All Protections
• AV kill from nt authority\system account
• disable
• Shell

Bypassing PowerShell Security

• bypass behavior based detection
• Defender’s Exclusions paths to download and execute tools
• list of writable directories in Windows:

Installed .NET Frameworks

cmd /c dir /A:D C:\Windows\Microsoft.NET\Framework ; cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP" ; cmd /c reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP" /s

AMSI.fail