Windows Defender update used by hackers
A recent update to Windows 10's Microsoft Windows Defender antivirus
solution Microsoft Defender version 4.18.2007.9 can be used to download
malware and other files to a Windows computer.
Legitimate operating system files that can be abused for malicious
purposes are known as living-off-the-land binaries or LOLBINs.
In a recent Microsoft Windows Defender update version 4.18.2007.9, the
command-line MpCmdRun.exe tool has been updated to download malicious
files from a remote location.
With this new feature, Microsoft Defender is now part of the long list of
Windows programs that can be abused by local attackers.
a recent update to Microsoft Windows Defender's version 4.18.2007.9
command-line tool now includes a new -DownloadFile command-line
argument.
How they use Windows Defender last update
This directive allows a local user to use the Microsoft Anti malware Service Command Line Utility (MpCmdRun.exe) to download a file from a remote location using the following command: MpCmdRun.exe -DownloadFile -url [url] -path [path_to_save_file]
you can find it in this path:
C:\ProgramData\Microsoft\Windows Defender\Platform\[your version]
the new version
With this discovery, administrators now have an additional Windows executable that they need to monitor so that it is not used against them.
if you are using the old version of Microsoft Windows Defender update
version 4.18.2004.6-0 you will not see DownloadFile argument for the same
tool.
the old version
