Weakness In Windows Defender Lets Malware Slip Through Via SMB Shares

CyberArk says the manner in which Defender scans for malicious executables in SMB shares gives attackers an opening.

Researchers at CyberArk Labs have devised what they claimed is a relatively simple way for attackers to sneak known malware past Windows Defender and get it to execute on devices running Windows 10 and Windows 8.1.
The tactic will likely work against other anti-virus tools as well, CyberArk said in an
advisory
Thursday. But for the moment it has only been tested and shown to work against Windows Defender. As many as 480 million devices with Windows Defender are completely unprotected against attacks that use the approach, the security vendor warned.
The technique that CyberArk has developed exploits a weakness in the process that Windows Defender uses for antivirus scanning of Server Message Block (SMB) shares. The vulnerability gives attackers a way to trick Windows Defender into scanning a different file than the one carrying the malware and that is being executed on a system.
Attackers can execute known malware under the guise of a legitimate file over an SMB server, CyberArk said. Imagine a situation where you double-click a file and Windows loads that file, but your antivirus scans another file or even scans nothing at all.
In a statement, a Microsoft spokeswoman downplayed the severity of the threat posed by the CyberArk exploit.
“The technique described has limited practical applicability, since it requires an attacker to first gain privileges or control of an internal server, the spokeswoman said. Should the attacker achieve that prerequisite, Windows Defender Antivirus and Windows Defender Advanced Threat Protection will detect further actions by the attacker.”
Steve Lowing, a product and marketing lead at CyberArk says the problem has to do with the manner in which Windows Defender handles processes loading in SMB shares.
In theory, Windows Defender should treat the process flow for handling SMB loading exactly like it would for loading a local file on your C drive, he says. The process should not be any different in the sense of opening and reading a file, Lowing says.
But CyberArks investigation showed that Windows Defender has a different code execution pathway and poor error handling for SMB loaded files. Through our evaluation and analysis of this weakness, depending on SMB server responses, Defender would indicate success—or, no malware—responses when the file was loaded from an SMB server.
CyberArks attack method involved implementing a custom SMB server and creating a pseudo-server to differentiate requests being made by Windows Defender and those made by other Windows native processes. Then, by manipulating the responses to those requests, CyberArk said it could get malware to bypass Defenders scanning.
For example when Windows Defender requests a malicious executable file for scanning from the SMB server, the pseudo-server would identify the origin of the request and send it a benign file to scan instead. As an example, CyberArk said it got Windows Defender to detect the Mimikatz post-exploitation tool as a completely different and benign file. Similarly, the SMB server could also be made to block scanning request in a manner that would cause Defender to eventually give up attempting to intercept the file and let it run normally.
It is fairly easy for someone that wants to leverage this weakness in Defender to implement their own SMB server, Lowing says.
The most obvious attack vector would be through a phishing campaign where the attacker would either have already compromised an internal server or even the endpoint where the email is being read, he notes. The end user would need to be tricked into running the file and the file would need to be served up from a nefarious SMB server. An effective attacker would be able to accomplish both of these tasks.
Related content:
Microsoft Builds Automation into Windows Defender ATP
Windows DoubleAgent Attack Turns AV Tools into Malware
Known Security Flaw Found In More Antivirus Products
10 Security Product Flaw Scares
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Weakness In Windows Defender Lets Malware Slip Through Via SMB Shares