I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of the files.
Let's pick a (dumb) example: Assume, the Brave browser is classified as an unwanted application. How could or would a user be able to alter the binary to evade detection?