I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of the files.

Let's pick a (dumb) example: Assume, the Brave browser is classified as an unwanted application. How could or would a user be able to alter the binary to evade detection?

  • XY answer: Why not use a whitelist instead? There are an infinity of unwanted applications and a very finite number a person needs to do their job. They could always ask you to add exceptions as needed. Jul 18 at 13:44

1 Answer 1


Re-combining binaries to be in different but functionally equivalent forms which evade anti-virus is a fairly trivial problem. There is a class of tools "obsfucation tools" to automate this process which can either re-arrange portions of the binary or encrypt their contents. Can your average end user do it? No. But it would be trivial for a determined attacker.

Some AV products have some protection against this (by predicting and/or noticing the output from the most common tools), but it's not reasonable or feasible for any such mechanism to detect all potential obsfucations. Plus the more you detect, the more false positives you will get.

In designing a security policy, making a whitelist would probably be easier than a blacklist. Likewise, other permissions and security settings should be set outside of simply installing a managed anti-virus. For example, making sure users do not have permission to run common software installers or add entries to the system startup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .