Security News > 2022 > January > Microsoft Defender weakness lets hackers bypass malware detection

Threat actors can take advantage of a weakness that affects Microsoft Defender antivirus on Windows to learn locations excluded from scanning and plant malware there.

Like any antivirus solution, Microsoft Defender lets users add locations on their systems that should be excluded from malware scans.

A security architect versed in protecting the Microsoft stack, McNulty warns that Microsoft Defender on a server has "Automatic exclusions that get enabled when specific roles or features are installed" and these do not cover custom locations.

In tests done by BleepingComputer, a malware strain executed from an excluded folder ran unhindered on the Windows system and triggered no alert from Microsoft Defender.

We used a sample of Conti ransomware and when it executed from a normal location Microsoft Defender kicked in and blocked the malware.

After placing Conti malware in an excluded folder and running it from there, Microsoft Defender did not show any warning and did not take any action, allowing the ransomware to encrypt the machine.

News URL

https://www.bleepingcomputer.com/news/security/microsoft-defender-weakness-lets-hackers-bypass-malware-detection/