DEF CON 31 - Defender Pretender When Windows Defender Updates Become a Security Risk -Bar, Attias

The signature update process is critical to EDR's effectiveness against emerging threats. The security update process must be highly secured, as demonstrated by the Flame malware attack that leveraged a rogue certificate for lateral movement. Nation-state capabilities are typically required for such an attack, given that signature update files are digitally signed by Microsoft.

We wondered if we could achieve similar capabilities running as an unprivileged user without possessing a rough certificate, instead we aimed to turn the original Windows …

attack capabilities certificate con critical def def con def con 31 defender edr emerging emerging threats lateral movement malware malware attack nation pretender process risk rogue security security risk security update signature state threats update updates windows windows defender