Microsoft Defender for Endpoint exposes destructive behavior by examining script file writes and course of action executions. Resulting from the nature of World-wide-web shells, static analysis is not effective—as we have proven, it is pretty simple to modify web shells and bypass static protections