defender-opsec
Installation
SKILL.md
Defender OPSEC for Pentest Engagements
Use this skill at the start of any authorized penetration test to prevent Windows Defender from uploading engagement artifacts (target IPs, exploit code, credentials, tooling) to Microsoft cloud services.
Why this matters
Defender's cloud features upload data to Microsoft:
| Feature | What it sends |
|---|---|
| Cloud-delivered protection (MAPS) | File hashes, file paths, partial file contents, process behavior, URLs, network connection metadata |
| Automatic sample submission | Entire suspicious files — scripts, exploits, payloads, wordlists |
| Diagnostic data | Telemetry on detection events, including target IPs and hostnames |