Page 10

• Use publicly known bypasses of AMSI and Windows Defender to run metasploit payloads from memory

• Enumerate and abuse exclusions for Windows defender