Microsoft Defender vulnerability allows malware nesting

Microsoft’s own virus scanner solution repeatedly secures the top spot in expert tests. Now, a nasty Microsoft Defender security flaw ensures that stray malware can infiltrate PCs and notebooks.

Microsoft Defender vulnerability on Windows 10

An access rights vulnerability is currently causing an annoying Microsoft Defender security flaw. This allows malware to hide from the virus scanner and thus infect PCs and notebooks.

With the help of a simple command, every logged-in user is able to read the list of scan exceptions of the Microsoft virus scanner. If malware is placed in this directory, it becomes invisible to threat scanning.

IT security researcher Antonio Cocomazzi from SentinelOne reported the vulnerability via Twitter. It is not possible to say for sure whether this is already being actively exploited.

https://twitter.com/splinter_code/status/1481073265380581381

However, not only local exception rules on individual systems are affected, but also Windows domains with scan exceptions defined via group policies. Windows 10 build 21H1 and build 21H2 are affected by the vulnerability, while Windows 11 does not have the Microsoft Defender vulnerability.

As early as May 2021, Paul Bolten via Twitter reported the vulnerability, but it has still not been closed since then.

Easy game

The read rights for all users or “Authenticated Users” makes it easy for malware software to access the PC. However, professional attackers can hide the malware from third-party antivirus solutions with a little more effort, without using the scanning exceptions.

Anti-virus software manufacturers regularly provide new signatures and also heuristic methods, which are usually already cracked within a few minutes. Thus, malware has an easy game again in a customized version. This step is unnecessarily simplified by the Microsoft Defender security vulnerability.

How to fix the vulnerability

However, checking and adjusting the permissions is not a problem for experienced users with the help of the registry editor regedit. This can be easily viewed in the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions

.
It is unclear whether Microsoft will be able to address and fix the problem with an update.