The Mechanics of Defense Evasion | Huntress

A Huntress blog post surveys seven real-world defense-evasion cases—manipulating AV exclusions and settings, uninstalling or killing security agents, highly obfuscated PowerShell (including AMSI evasion and AsyncRAT), embedding executables in LNK shortcuts, social-engineering user prompts, and reflective loading/process injection—illustrating how attackers evade detection, with examples, small IOCs (e.g., new50.noip.me), and notes for defender detection.