[WMI] Add defender module

[XiaoliChan]

Description

Ported from wmiexec-Pro (https://github.com/XiaoliChan/wmiexec-Pro). Supports check / disable / enable / exclude / remove actions over the smb and wmi protocols against the class MSFT_MpPreference in root/Microsoft/Windows/Defender namespace.

Method invocation (disable/enable/exclude/remove) relies on kwargs-style WMI method calling - only supplied InParams are sent, unspecified ones are marked null via NdTable, preserving existing configuration. This requires the impacket wmi-Call branch (pending upstream PR fortra/impacket#2272).

Disable/enable verify the resulting state and warns when settings did not change: on some systems (e.g. Windows 11 as local admin, Tamper Protection), disable/enable is blocked while exclusions still work.

Verified against Server 2019 with Cortex XDR present: all actions tested over both smb and wmi protocols, exclusions confirmed added and removed via check.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

1. Install impacket with PR [WMI] Support kwargs-style style method calling fortra/impacket#2272

Screenshots (if appropriate):

• Target System: Server 2019

• Enable/Disable

• Add exclusion

• Remove exclusion

Checklist:

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• [xI have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[github-actions]

It looks like the PR template may not have been filled out. The following sections appear to be missing:

• Setup guide for the review

Please edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks!

[NeffIsBack]

Thanks for the PR, crazy that this is possible tho😅

[XiaoliChan]

Thanks for the PR, crazy that this is possible tho😅

System running 2022 may not work with disable/enable, but add/remove exclusion works XD

[NeffIsBack]

Thanks for the PR, crazy that this is possible tho😅

System running 2022 may not work with disable/enable, but add/remove exclusion works XD

What about 2025 and Win 10/11?

[XiaoliChan]

Thanks for the PR, crazy that this is possible tho😅

System running 2022 may not work with disable/enable, but add/remove exclusion works XD

What about 2025 and Win 10/11?

Haven’t test it, I only have server 2019 in my ENV 🫠