Defender-Pretender: When Windows Defender Updates Become a Security Risk

...In this talk we will present our journey starting with a deep dive into Windows Defender architecture, the signature database format and the signature update process, focusing on the security verification logic. We will present how an adversary can totally own any Windows agent and server in the world by exploiting a powerful 0day vulnerability that even we didn't expect to discover. Enterprise machines are also at risk since the vulnerability affects Microsoft 365 Defender as well....

By: Omer Attias …

adversary agent architecture can database deep dive defender dive exploiting journey logic own pretender process risk security security risk server signature update updates verification windows windows defender world