New DefenderWrite Tool Let Attackers Inject Malicious DLLs into AV Executable Folders
A new tool, DefenderWrite, has been developed to exploit whitelisted Windows programs, allowing for the bypassing of protections and the writing of arbitrary files into antivirus executable folders. This method potentially enables malware persistence and…
A new tool, DefenderWrite, has been developed to exploit whitelisted Windows programs, allowing for the bypassing of protections and the writing of arbitrary files into antivirus executable folders. This method potentially enables malware persistence and evasion.
Created by cybersecurity expert Two Seven One Three, DefenderWrite introduces a technique for penetration testers and red teams to deploy payloads in protected locations without requiring kernel-level access.
This highlights ongoing challenges in antivirus self-protection mechanisms, as folders containing AV executables are typically shielded from modifications to prevent tampering.
Attackers can leverage system programs whitelisted by antivirus vendors for updates and installations to inject malicious DLLs, thus using the AV's own safeguards against it.
The tool, shared via GitHub, has sparked discussions regarding the balance between operational necessities for AV software and security risks within enterprise environments.
Exploiting Whitelisted Programs for Arbitrary Writes
DefenderWrite's core innovation involves scanning Windows executables to identify those permitted to access AV folders.
By enumerating .exe files in directories like C:\Windows, the tool uses process creation and remote DLL injection to test write capabilities into protected paths.
DefenderWrite's core innovation involves scanning Windows executables to identify those permitted to access AV folders.
A custom DLL performs the file write operation and reports success or failure, allowing the tool to identify exploitable processes such as msiexec.exe without triggering defenses.
Testing on Windows 11 24H2 with Microsoft Defender version 4.18.25070.5-0 revealed four such programs: msiexec.exe, Register-CimProvider.exe, svchost.exe, and lsass.exe.
This approach extends beyond Microsoft Defender, with similar vulnerabilities confirmed in BitDefender, TrendMicro Antivirus Plus, and Avast. Specific details remain undisclosed to encourage independent verification.
DefenderWrite supports key parameters for targeted operations, including TargetExePath for the host executable, FullDLLPath for the injectable library, and FileToWrite for the destination path within the AV folder. An optional "c" flag simplifies copying the DLL to the specified location remotely.
An accompanying PowerShell script, Run_Check.ps1, automates the scanning of C:\Windows executables and logs whitelisted ones for further exploitation.
Users can customize the script for their environment, making it suitable for red team simulations or defensive assessments.
The GitHub repository provides full source code and documentation, emphasizing ethical use in authorized testing only. The developer, Two Seven One Three, shares additional pentest insights and encourages community experiments to strengthen AV resilience.
Once a malicious payload resides in an AV folder, it benefits from the same exceptions that shield legitimate files, evading scans and potentially achieving long-term persistence.
This technique underscores the need for vendors to audit whitelisting policies and implement stricter process isolation during updates. While not a zero-day vulnerability, DefenderWrite reveals systemic gaps that could aid real-world attacks if unaddressed.
Organizations should monitor AV update mechanisms and consider layered defenses beyond traditional file permissions. With the tool's open availability, broader adoption in security research circles is expected to push for improved protections across popular antivirus solutions.
Based on reporting by Cyber Security News.