Attackers Exploit Defender for Endpoint Cloud API to Bypass Authentication and Disrupt Incident Response
## Microsoft Defender for Endpoint Vulnerabilities
Microsoft Defender for Endpoint Vulnerabilities
Research indicates that Microsoft Defender for Endpoint's cloud communication can potentially be exploited to bypass authentication, intercept commands, and spoof results. This vulnerability could allow attackers to disrupt incident response activities and mislead analysts.
Research reveals that several backend endpoints accept requests without proper token validation. This vulnerability allows unauthenticated manipulation if a machine ID and tenant ID are known. Microsoft has reportedly classified the severity of these issues as low, and it remains unclear when fixes will be implemented.
The Defender for Endpoint agent, comprising MsSense.exe and SenseIR.exe, exhibits weaknesses in server-side validation. Once Transport Layer Security (TLS) pinning is bypassed, the agent’s network traffic utilizes a /edr/commands/cnc endpoint for various commands. Although requests contain Authorization and Msadeviceticket headers, the backend does not enforce these restrictions.
An attacker aware of a machine ID and tenant ID can intercept pending commands before the legitimate agent, leading to the agent receiving no commands. The attacker could also upload falsified telemetry or files to Azure Blob storage, potentially polluting evidence or misreporting outcomes.
This vulnerability could allow attackers to disrupt incident response activities and mislead analysts.
A similar vulnerability affects the /senseir/v1/actions/ endpoint, which manages Live Response and Automated Investigation. Attackers can secure a CloudLR token using only a machine ID, enabling them to request actions, access Azure Blob URLs, and upload manipulated data. This could lead to misleading operational impacts, such as falsely reporting device isolation or seeding investigation packages with malicious files.
Further investigation revealed that attackers could access IR-exclusions from the registration endpoint using an organization ID, which is accessible to any user from the registry. Although these exclusions do not disable detection, they influence automated and manual incident response behavior.
An unauthenticated call to /edr/commands/cnc may also return a configuration bundle containing important monitoring and reduction data, providing insight into potential rules and blind spots.
Organizations should monitor for unexpected CNC/action polling patterns, verify that isolation states align with the actual host status, and restrict access to identifiers. Additionally, setting detections for suspicious Azure Blob uploads linked to Defender workflows is recommended. Network controls that limit access to trusted paths can mitigate race conditions.
Until Microsoft enforces backend token validation and strengthens token issuance, incident responders should assume cloud command channels could be compromised and conduct out-of-band verification of results.
Based on reporting by GBHackers.