Microsoft removed the ability to download files using Windows Defender after it was shown how it could be used by attackers to download malware.
Last week, we reported that Microsoft added the ability to download files using Windows Defender for an unknown reason and without an update.
When this was discovered, the cybersecurity community worried that Microsoft would allow Defender to be used by attackers as LOLBIN.
LOLBINs are legitimate operating system that hackers can use for malicious purposes.
To download a file, users could run the Microsoft Antimalware Service command-line utility (MpCmdRun.exe) with the -DownloadFile argument, as shown below
In its tests, Bleedingcomputer managed to download any file it wanted, including ransomware, to systems .
Microsoft is removing the download feature
With yesterday's release of Windows Defender version 4.18.2009.2-0, Bleedingcomputer discovered that Microsoft changed the capabilities of MpCmdRun.exe.
This time, Microsoft removed the ability to download files via the MpCmdRun.exe command-line utility.
Users attempting to download a file using MpCmdRun.exe will see the error “CmdTool: Invalid command line argument.” The -DownloadFile command line option has already been removed from the help screen.
Attackers use any tool they can to their advantage, especially those that do not require approval, such as Windows binaries.
The use of LOLBINs in attacks is not theoretical, as they have been used in the past by the TA505 groupin ransomware and malware.
Removing this option from Windows Defender is very right, as it makes no sense to offer threat actors additional tools to compromise systems .
