Microsoft removes Windows Defender download feature after security concerns

[Gandalf_The_Grey]

Microsoft has removed the ability to download files using Windows Defender after it was demonstrated how it could be used by attackers to download malware onto a computer.

Last week, we reported that Microsoft quietly added the ability to download files using Windows Defender for an unknown reason.

When this was discovered, there was concern from the cybersecurity community that Microsoft would allow Defender to be abused by attackers as a LOLBIN.

Microsoft removes download feature
With yesterday's release of the Windows Defender Antimalware Client version 4.18.2009.2-0, BleepingComptuer discovered that Microsoft once again quietly changed the MpCmdRun.exe features.

This time, Microsoft removed the ability to download files via the MpCmdRun.exe command-line utility.

Users who attempt to download a file using MpCmdRun.exe will be shown an error stating "CmdTool: Invalid command line argument." The -DownloadFile command line option has already been removed from the help screen.

Threat actors will use every tool they can to their advantage, especially ones that may be automatically allowed, such as Window binaries.

Using LOLBINs in attacks is not theoretical, as they have been used in the past by the TA505 APT group, ransomware attacks, and other malware attacks.

Removing this option from Windows Defender is a good thing as it makes no sense giving threat actors additional tools to compromise our systems.

Read the full article by Bleeping Computer here:

Microsoft removes Windows Defender ability after security concerns

Microsoft has removed the ability to download files using Windows Defender after it was demonstrated how it could be used by attackers to download malware onto a computer.

www.bleepingcomputer.com