A new sophisticated method for bypassing Microsoft's Windows Defender antivirus protection by combining direct system calls with XOR encryption techniques.
See also: Microsoft Defender: Detecting unsecured Wi-Fi networks and notifying users
The research, published this week, reveals critical vulnerabilities in one of the most widespread security solutions included in every Windows installation.
This innovative technique exploits the fundamental architecture of the Windows operating system, exploiting the boundaries between user mode (Ring 3) and kernel mode (Ring 0). By bypassing the traditional Windows execution flow, attackers can execute malicious code without triggering defense mechanisms.
According to research published by Hackmosphere, the technique works by avoiding the traditional execution path, where applications call Windows API functions through libraries like kernel32.dll, which then forwards the requests to ntdll.dll before making the actual system call to the kernel.
See also: Microsoft Patch Tuesday November 2024: Fixes 91 vulnerabilities
Instead, attackers directly execute the syscall command with the appropriate syscall number, bypassing any user-level security monitoring.
The researchers further strengthened this attack by implementing XOR encryption to hide malicious code from Windows Defender. This simple but effective cryptographic technique converts malicious code into an unrecognizable form that evades signature-based detection.
XOR encryption is based on the principle of bitwise XOR, where each bit of the ciphertext is combined with the corresponding bit from a secret key. When the payload is ready to execute, it is decrypted in memory, leaving no traces on disk that could be detected by antivirus solutions.
Microsoft has previously referred to similar circumvention techniques, stating that they have “limited practical application,” as they often require user interaction to execute. However, security experts disagree, pointing out that such techniques could easily be incorporated into broader attack chains.
See also: Microsoft Patch Tuesday October 2024 fixes 118 vulnerabilities
Despite the XOR encryption techniques that affect it, Windows Defender (now known as Microsoft Defender Antivirus ) is the pre-installed antivirus and threat protection program in Windows 10 and Windows 11. It is Microsoft's core security tool and has evolved a lot in recent years. Windows Defender offers many services such as: Real-time detection of viruses, malware, spyware and other threats, cloud-based protection to detect new threats faster, built-in firewall control and network security settings, ransomware protection with the ability to control access to sensitive folders, sandboxing in an isolated environment so that, even if hacked, it does not spread to the system, automatic updates through Windows Update.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
