Windows Defender update used by hackers

A recent update to Windows 10's Microsoft Windows Defender antivirus solution Microsoft Defender version 4.18.2007.9 can be used to download malware and other files to a Windows computer.

Legitimate operating system files that can be abused for malicious purposes are known as living-off-the-land binaries or LOLBINs.

In a recent Microsoft Windows Defender update version 4.18.2007.9, the command-line MpCmdRun.exe tool has been updated to download malicious files from a remote location.

With this new feature, Microsoft Defender is now part of the long list of Windows programs that can be abused by local attackers.

a recent update to Microsoft Windows Defender's version 4.18.2007.9 command-line tool now includes a new -DownloadFile command-line argument.

How they use Windows Defender last update

This directive allows a local user to use the Microsoft Anti malware Service Command Line Utility (MpCmdRun.exe) to download a file from a remote location using the following command: MpCmdRun.exe -DownloadFile -url [url] -path [path_to_save_file]

you can find it in this path:

C:\ProgramData\Microsoft\Windows Defender\Platform\[your version]

the new version

The good news is that Microsoft Windows Defender will detect malicious files downloaded with MpCmdRun.exe, but it is unknown if other AV software will allow this program to bypass their detection.

With this discovery, administrators now have an additional Windows executable that they need to monitor so that it is not used against them.

if you are using the old version of Microsoft Windows Defender update version 4.18.2004.6-0 you will not see DownloadFile argument for the same tool.

the old version

" So, What can we describe this ? a mistake from Microsoft or for helpful reasons "