Security News > 2022 > January > Microsoft Defender weakness lets hackers bypass malware detection
Threat actors can take advantage of a weakness that affects Microsoft Defender antivirus on Windows to learn locations excluded from scanning and plant malware there.
Like any antivirus solution, Microsoft Defender lets users add locations on their systems that should be excluded from malware scans.
A security architect versed in protecting the Microsoft stack, McNulty warns that Microsoft Defender on a server has "Automatic exclusions that get enabled when specific roles or features are installed" and these do not cover custom locations.
In tests done by BleepingComputer, a malware strain executed from an excluded folder ran unhindered on the Windows system and triggered no alert from Microsoft Defender.
We used a sample of Conti ransomware and when it executed from a normal location Microsoft Defender kicked in and blocked the malware.
After placing Conti malware in an excluded folder and running it from there, Microsoft Defender did not show any warning and did not take any action, allowing the ransomware to encrypt the machine.
News URL
Related news
- Microsoft admits GitHub hosted malware that infected almost a million devices (source)
- Microsoft: New RAT malware used for crypto theft, reconnaissance (source)
- Microsoft Trust Signing service abused to code-sign malware (source)
- Microsoft Trusted Signing service abused to code-sign malware (source)
- Critical flaw in Next.js lets hackers bypass authorization (source)
- New Android malware uses Microsoft’s .NET MAUI to evade detection (source)
- Update VMware Tools for Windows Now: High-Severity Flaw Lets Hackers Bypass Authentication (source)
- Chinese FamousSparrow hackers deploy upgraded malware in attacks (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- New Windows 11 trick lets you bypass Microsoft Account requirement (source)