Last week, we reported that Microsoft quietly added the ability to download files through Windows Defender for some unknown reason.
When this was discovered, the community security in cyberspace expressed concerns about why Microsoft would allow Defender to be used by attackers like LOLBIN.
LOLBINs, or living-off-the-land binaries, are legitimate operating system files that can be compromised for malicious purposes.
MpCmdRun.exe -DownloadFile -url [url] -path [path_to_save_file]
In tests conducted by security researchers, I was able to download any files (even ransomware_, to their systems.
Το Windows Defender μπορεί ανιχνεύσει γρήγορα το κακόβουλο λογισμικό, αλλά κάποιο άλλο security software δεν θα εντοπίσει τη λήψη που πραγματοποιήθηκε από την εφαρμογή ασφαλείας της Microsoft.
With yesterday's release of the Windows Defender Antimalware Client in version 4.18.2009.2-0, it seems that Microsoft has changed the capabilities of MpCmdRun.exe.
Microsoft has effectively removed the ability to download files through the prolettercommand prompt MpCmdRun.exe.
So if you try to download a file using MpCmdRun.exe you will encounter an error stating "CmdTool: Invalid command line argument."
Also the -DownloadFile command line setting has been removed from the help screen.