[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIDxDIwjfnFoZREXbNRfi7F87ye7RTZ-sQ3S-HqwSUMU":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":28},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"9df6162e-d2d4-4ad1-8cd8-d18382904e9f","⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV\u002FEDR kille...","a-defense-evasion-tool-called-exengine-is-being-sold-as-a-service-marketed-as-an-493862","⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV\u002FEDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC https:\u002F\u002Ft.co\u002FtO4rkRRoks","ExEngine is a defense evasion tool being marketed and sold as a service that targets mainstream antivirus and EDR solutions including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination capabilities with a Ring-3 rootkit and UAC bypass functionality to evade security controls. This represents a growing threat landscape where adversaries purchase pre-built evasion capabilities to support broader attack campaigns.","ExEngine defense evasion tool sold as service to disable AV\u002FEDR software.","https:\u002F\u002Fx.com\u002FDarkWebInformer\u002Fstatus\u002F2050259718950854866","https:\u002F\u002Fpbs.twimg.com\u002Famplify_video_thumb\u002F2050258644894171136\u002Fimg\u002FLvUuJo9BF3UwusxB.jpg","2026-05-01T17:03:03+00:00","2026-05-01T18:00:09.220874+00:00",8,[17,20,22,24],{"name":18,"type":19},"Windows Defender","product",{"name":21,"type":19},"Malwarebytes",{"name":23,"type":19},"Bitdefender",{"name":25,"type":19},"Avast","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":30,"value":51,"context":52},"ExEngine","Defense evasion tool sold as a service; targets AV\u002FEDR software with rootkit and UAC bypass",[18,21,23],{"controls":55,"vendors":131},[56,84,105],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,68,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":57,"product_name":65,"url":66,"description":67},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[89,97],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,115,123],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":111,"product_name":112,"url":113,"description":114},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[132,137],{"slug":133,"name":23,"logo_path":134,"roles":135},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png",[136],"affected",{"slug":98,"name":99,"logo_path":100,"roles":138},[136]]