That's why cloud delivered detection is good as well edrs including defender atp and others. I "attack simulated" as many ways as I could, disabling defender.

That's why cloud delivered detection is good as well edrs including defender atp and others. I "attack simulated" as many ways as I could, disabling defender. If anything on our environment so much as changes a registry key, service or adds an exclusion we get alerts for it, no need for cloud delivered protection/atp to take its time analyzing behavior. OPs writeup is great but it has nothing to do with behavioral analysis. It doesn't even matter what bypass you found. I spent so much time defeating defender at one point, as soon as my payload breaks opsec on a cloud delivered box (e.g.:run "whoami") in about a day defender starts catching it. I can almost guarantee this bypass can only last as long as attackers use it stealthily. Enough automatic detections will get human eyes on it.