Microsoft has removed the ability to download files through Windows Defender after it turned out how it could be used by intruders to download malware to a computer.
Last week, we reported that Microsoft quietly added the ability to download files through Windows Defender for some unknown reason.
When this was discovered, the cyber security community expressed concern that Microsoft would allow Defender to be used by attackers as LOLBIN.
LOLBINs, or living-off-the-land binaries, are legitimate operating system files that can be compromised for malicious purposes.
To download a file, users had to run one utility command line of the Microsoft Antimalware service (MpCmdRun.exe) with the -DownloadFile command, as shown below.
MpCmdRun.exe -DownloadFile -url [url] -path [path_to_save_file]
In tests conducted by security researchers, I was able to download any files (even ransomware_, to their systems.
Windows Defender can quickly detect malware software, αλλά κάποιο άλλο λογισμικό ασφαλείας δεν θα εντοπίσει τη λήψη που πραγματοποιήθηκε από την application Microsoft Security.
With yesterday's release of the Windows Defender Antimalware Client on version 4.18.2009.2-0, it appears that Microsoft has changed the capabilities of MpCmdRun.exe.
Microsoft has virtually removed the ability to download files through the command line utility MpCmdRun.exe.
So if you try to download a file using MpCmdRun.exe you will encounter an error stating "CmdTool: Invalid command line argument."
Also the -DownloadFile command line setting has been removed from the help screen.
