If Defender is removed by windows-defender-remover, it will fail to detect threats and the process will exit.

[bytecategory]

PS C:\> Get-MpComputerStatus
Get-MpComputerStatus : Provider load failure
At line:1 char:1
+ Get-MpComputerStatus
+ ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_MpComputerStatus:ROOT\Microsoft\...pComputerStatus) [Get-MpComputerS
   tatus], CimException
    + FullyQualifiedErrorId : HRESULT 0x80041013,Get-MpComputerStatus

PS C:\> .\ShieldBreak.exe
[+] \??\C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4} was created.
[+] Cloud provider has been registered.
[+] Attached cloud provider to C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4}
[+] Placeholder created.
[+] \BaseNamedObjects\Restricted\WD_TARGET_{D704F330-D6B3-4434-A383-BD2D4EF54EC4} object manager directory created
[+] \BaseNamedObjects\Restricted\WD_SHADOW_{D704F330-D6B3-4434-A383-BD2D4EF54EC4} object manager directory created
[+] WD_SCAN <=> \??\C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4} object link created
[+] WD_SCAN <=> \CLFS\??\C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4} object link created
[+] Created \??\C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4}\BERLIN
[+] Copied C:\Windows\System32\ntdll.dll => C:\ShieldBreak_{D704F330-D6B3-4434-A383-BD2D4EF54EC4}\BERLIN:stream
[*] Scan initiated for \\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{D704F330-D6B3-4434-A383-BD2D4EF54EC4}\WD_SCAN\BERLIN
[*] Please wait...
[-] No threats found.

[Salah-Code-Lab]

i mean that is Logical
ShieldBreak Failing is very Expected because the engine which it abuses isn't there to scan or do anything really
and you did a Complete Wipe Down So i mean what did you expect ?

Plus defender isn't there anymore of course it wont detect any threats There isn't an AV in the first place

[bytecategory]

i mean that is Logical ShieldBreak Failing is very Expected because the engine which it abuses isn't there to scan or do anything really and you did a Complete Wipe Down So i mean what did you expect ?

Plus defender isn't there anymore of course it wont detect any threats There isn't an AV in the first place

unzip -p eicar_com.zip eicar.com | cat

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*---
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Good question. If the contents of the zip file change, that also cannot be detected.

[bytecategory]

What I mean is—regarding the "No threats found" result—there are two possible scenarios: either the ZIP file is harmless, or Defender lacks the corresponding RPC/WMI endpoint. The program's expected behavior is to distinguish between these two cases. @Salah-Code-Lab

[Salah-Code-Lab]

What I mean is—regarding the "No threats found" result—there are two possible scenarios: either the ZIP file is harmless, or Defender lacks the corresponding RPC/WMI endpoint. The program's expected behavior is to distinguish between these two cases. @Salah-Code-Lab

i get it now
but here is the thing
The AV or Defender Must flag the Executable or whatever as a Malicious binary for the exploit to work anyway
if the Exploit did not need that flag or handling by Windows Defender then it wouldn't need the EICAR sample or any other sample that triggers Defender (Which in your Case is non-Existent that Extra handling wont be done which then cannot be abused because it is not there or hadn't been executed)

so in the end or the TLDR
the exploit requires Defender to actively process and flag the file to trigger the flaw. If Defender is removed, there's no engine to interact with the payload, so the vulnerability conditions can never be met in the first place.

Now make sure defender exists for this one because if it doesn't as i said there wont be Any AV to trigger anything
If the ZIP file is harmless you can test that
That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it
That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics

But if the ZIP is not detected even when Microsoft Defender is not there then the flaw is with the ZIP file itself

[bytecategory]

That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics

So what? Can a single EICAR anti-virus test string really trigger Defender's heuristic detection? Heuristic detection is designed to handle polymorphic viruses.

You didn't get it.

[bytecategory]

What I mean is—regarding the "No threats found" result—there are two possible scenarios: either the ZIP file is harmless, or Defender lacks the corresponding RPC/WMI endpoint. The program's expected behavior is to distinguish between these two cases. @Salah-Code-Lab

i get it now but here is the thing The AV or Defender Must flag the Executable or whatever as a Malicious binary for the exploit to work anyway if the Exploit did not need that flag or handling by Windows Defender then it wouldn't need the EICAR sample or any other sample that triggers Defender (Which in your Case is non-Existent that Extra handling wont be done which then cannot be abused because it is not there or hadn't been executed)

Please do not reply anymore.

[Salah-Code-Lab]

Okay Man whatever what you see
communication is my problem it seems because English is my second language
and say whatever what you want about me
because i don't really care at the end of the day
Doesn't invalidate anything FYI

because now i would be wasting my time on someone who hinged on Heuristics instead of Signature Based Detection
Okay mate

forgot one thing
The Irony here is just Staggering
You misunderstood sample with 68-byte static string

"So what? Can a single EICAR anti-virus test string really trigger Defender's heuristic detection? Heuristic detection is designed to handle polymorphic viruses."

very nice I told you its a sample
You see things sometimes are clearer than what they really are

[bytecategory]

i mean that is Logical ShieldBreak Failing is very Expected because the engine which it abuses isn't there to scan or do anything really and you did a Complete Wipe Down So i mean what did you expect ?
Plus defender isn't there anymore of course it wont detect any threats There isn't an AV in the first place

unzip -p eicar_com.zip eicar.com | cat

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*---
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Good question. If the contents of the zip file change, that also cannot be detected.

There are two scenarios where "No threats found" appears; the intention is to first send a query request to the MSFT_MpComputerStatus class within the ROOT\Microsoft\SecurityClient namespace, and then determine whether the second scenario applies.

[bytecategory]

Okay Man whatever what you see communication is my problem it seems because English is my second language and say whatever what you want about me because i don't really care at the end of the day Doesn't invalidate anything FYI

because now i would be wasting my time on someone who hinged on Heuristics instead of Signature Based Detection Okay mate

Well, maybe there was a problem with the translator.
It is clearly signature-based detection that was triggered, yet you are talking about heuristic detection.
Additionally, you were mistaken in thinking the ZIP file contained a malicious EXE file; that is incorrect.

[bytecategory]

https://share.gemini.google/JBjCsGB8WEDv
Get an AI evaluation (Bilingual: Chinese & English)

[Salah-Code-Lab]

i will reply to you one last time you Word hinger

the EICAR is NOT a malicious Executable its a testing sample Made to trigger Detections
I Said:
"If the ZIP file is harmless you can test that
That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it
That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics"
i don't know if you'd hinge on that one because i said Heuristics instead of Signature Based Detection

Second
If Microsoft Defender is Removed IT wont trigger or Find any threats the exploit itself is not the scanner
and it abuses Defender i told you that numerous times
No Threats Found is defender not finding any threats because it is Deleted and non Existent

[bytecategory]

i will reply to you one last time you Word hinger

the EICAR is NOT a malicious Executable its a testing sample Made to trigger Detections I Said: "If the ZIP file is harmless you can test that That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics" i don't know if you'd hinge on that one because i said Heuristics instead of Signature Based Detection

Second If Microsoft Defender is Removed IT wont trigger or Find any threats the exploit itself is not the scanner and it abuses Defender i told you that numerous times No Threats Found is defender not finding any threats because it is Deleted and non Existent

My point of view aligns with yours, but due to issues with your translator, you are unable to understand what I am expressing. @Salah-Code-Lab

[Salah-Code-Lab]

i will reply to you one last time you Word hinger
the EICAR is NOT a malicious Executable its a testing sample Made to trigger Detections I Said: "If the ZIP file is harmless you can test that That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics" i don't know if you'd hinge on that one because i said Heuristics instead of Signature Based Detection
Second If Microsoft Defender is Removed IT wont trigger or Find any threats the exploit itself is not the scanner and it abuses Defender i told you that numerous times No Threats Found is defender not finding any threats because it is Deleted and non Existent

My point of view aligns with yours, but due to issues with your translator, you are unable to understand what I am expressing. @Salah-Code-Lab

says the guy who doesn't understand why ripping Defender makes the Defender Reliant exploit Not work

[bytecategory]

i will reply to you one last time you Word hinger
the EICAR is NOT a malicious Executable its a testing sample Made to trigger Detections I Said: "If the ZIP file is harmless you can test that That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics" i don't know if you'd hinge on that one because i said Heuristics instead of Signature Based Detection
Second If Microsoft Defender is Removed IT wont trigger or Find any threats the exploit itself is not the scanner and it abuses Defender i told you that numerous times No Threats Found is defender not finding any threats because it is Deleted and non Existent

My point of view aligns with yours, but due to issues with your translator, you are unable to understand what I am expressing. @Salah-Code-Lab

says the guy who doesn't understand why ripping Defender makes the Defender Reliant exploit Not work

I understand perfectly well why it doesn't work. You are completely missing the point. My issue isn't that the exploit fails without Defender; it's how it fails. Returning 'No threats found' when the scanning engine is literally missing is a silent failure. A robust tool should catch the missing WMI/RPC endpoints and throw a fatal environment error, not falsely claim the file is clean.

[Salah-Code-Lab]

i will reply to you one last time you Word hinger
the EICAR is NOT a malicious Executable its a testing sample Made to trigger Detections I Said: "If the ZIP file is harmless you can test that That Sample is Harmless and is meant to trigger Defender but i'd recommend manually getting one identical to it That sample Doesn't do anything or execute anything but it is meant to trigger Defender Heuristics" i don't know if you'd hinge on that one because i said Heuristics instead of Signature Based Detection
Second If Microsoft Defender is Removed IT wont trigger or Find any threats the exploit itself is not the scanner and it abuses Defender i told you that numerous times No Threats Found is defender not finding any threats because it is Deleted and non Existent

My point of view aligns with yours, but due to issues with your translator, you are unable to understand what I am expressing. @Salah-Code-Lab

says the guy who doesn't understand why ripping Defender makes the Defender Reliant exploit Not work

I understand perfectly well why it doesn't work. You are completely missing the point. My issue isn't that the exploit fails without Defender; it's how it fails. Returning 'No threats found' when the scanning engine is literally missing is a silent failure. A robust tool should catch the missing WMI/RPC endpoints and throw a fatal environment error, not falsely claim the file is clean.

My bad
Your point is valid it should had reported that but i mean
A Exploit that relies on defender (Which is almost installed on every Windows not something that you would want Uninstalled)
will not account for that critical part being missing
i thought you meant all this time
Why would the exploit not work while defender is non existent

But hey i am not MSNightmare to tell you why i chose to tell you No Threats found instead of Environment is Incompatible

But the Title
"If Defender is removed by windows-defender-remover, it will fail to detect threats and the process will exit."
and the lack of explenation of anything is what got me to that idea
so issue on your and my part

Because if you are going to report an issue you should provide data not just dump the tool's Output
and me for not asking what was the issue exactly and what you were testing for
either way when you report and issue next time provide as much data as possible because people don't live in your mind