waits for wdavdaemon_enterprise processes and kills them. run with sudo.

swatmd.py

#!/usr/bin/env python3

import psutil
import time

def logDebug(msg):
	print(time.ctime() + " " + msg)

while True: 
	count = 0

	for p in psutil.process_iter():
		if "wdavdaemon_enterprise" == p.name():
			p.kill()
			p.wait()
			count = count +1

	logDebug("swatted: "+str(count))
	time.sleep(5)

It’s Microsoft’s Antivirus trying to check stuff on your machine. You can try killing it with this script, which is brute force, might not work and has its own problems. You can also try to add exemptions for the local monitoring of files and processes.

As a Security professional, writing here in case any of my employees come upon this gist.

To all, internal to my company or not, you might want to think twice before deliberately hindering an enterprise security tool.