Windows Defender Removes Controversial Download Option

Threat Watch

Threat Watch Windows Defender Removes Controversial Download Option

Windows Defender Removes Controversial Download Option

Earlier this month, Microsoft met backlash for adding a new “-DownloadFile” command line option to Windows Defender, enabling anyone with some level of access to the system to download files using a trusted application to potentially evade detection. Almost as quickly as it appeared without warning, as of version 4.18.2009.2-0 this feature has been quietly removed. Attempting to use the “-DownloadFile” option will once again return the message “CmdTool: Invalid command line argument.”

ANALYST NOTES

Defenders can still watch out for attempts to use this option by monitoring process execution events where “MpCmdRun.exe” is being launched with the “-DownloadFile”, “-path” or “-url” arguments. With the feature being removed quickly and quietly, chances are high that any instance of “MpCmdRun.exe” being launched with those three arguments will not be legitimate.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-removes-windows-defender-ability-after-security-concerns/

The war in Ukraine and its impact on how China views Taiwan

Digging through Rust to find Gold: Extracting Secrets from Rust Malware

5 Critical Criteria for evaluating Managed Detection & Response (MDR)

How Ransomware Capabilities Are Evolving and What You Can Do to Keep Your Organization Secure

Threat Watch