DefenderWrite Tool Let Attackers Inject Malicious DLLs into AV Executable Folders

[Khushal]

Content source

https://www.zerosalarium.com/2025/10/defenderwrite-abusing-whitelisted-programs-arbitrary-write.html

DefenderWrite Tool Let Attackers Inject Malicious DLLs into AV Executable Folders

Read more: New DefenderWrite Tool Let Attackers Inject Malicious DLLs into AV Executable Folders

DefenderWrite: Abusing Whitelisted Programs for Arbitrary Writes

DefenderWrite tool that helps find programs whitelisted by Antivirus and exploits these programs to write arbitrary files into the Antivirus's folder

www.zerosalarium.com

A new tool called DefenderWrite exploits whitelisted Windows programs to bypass protections and write arbitrary files into antivirus executable folders, potentially enabling malware persistence and evasion.

The core innovation behind DefenderWrite lies in systematically scanning Windows executables to find those permitted to access AV folders.

By identifying system programs that antivirus vendors whitelist for updates and installations, attackers can leverage these exceptions to inject malicious DLLs, turning the AV's own safeguards against it.

Some Antivirus have been successfully tested​

• Microsoft Windows Defender
• BitDefender Antivirus
• TrendMicro Antivirus Plus
• Avast Antivirus

 

[Parkinsond]

But SAC can block such injected malicious dll files.

 

[Khushal]

But SAC can block such injected malicious dll files.

He has given POC on his site. He is a well renowned red teamer.

 

[Parkinsond]

He has given POC on his site. He is a well renowned red teamer.

It will work if SAC is turned off.

 

[Khushal]

It will work if SAC is turned off.

Yes but still bigdefender, avast and trend micro were bypassed.

 

[Parkinsond]

Yes but still bigdefender, avast and trend micro were bypassed.

SAC is not exclusive for MD, it can be used with any 3rd party AV.

 

[Khushal]

SAC is not exclusive for MD, it can be used with any 3rd party AV.

correct but third party AVs must be reliable against such antiedr measures.

 

[Parkinsond]

correct but third party AVs must be reliable against such antiedr measures.

No one is reliable except family members (not all the time )