FYI:
Hackers Bypass Windows Defender Security — What You Need To Know
By Davey Winder, Forbes - March 31, 2025,
https://www.forbes.com/sites/daveywinder/2025/03/31/hackers-bypass-windows-defender-security-what-you-need-to-know/
Update, March 31, 2025: This story, originally published March 29, has been updated with an explanation of LOLBINS as well as further technical information regarding the Windows Defender Application Control security bypass from IBM X-Force red team operator Bobby Cooke.
When you thought that things couldn’t get much scarier for Windows users, elite red team hackers go and prove you wrong. First, there was a zero-day vulnerability leaving Windows passwords up for grabs, then a ransomware shocker as criminals put a $500,000 Windows threat up for rent, and even the discovery of a Windows rootkit to contend with. Now, it has been confirmed that there’s a way to bypass Windows Defender Application Control, which is meant to restrict application execution to trusted software, with all the implications that brings to the security party. Here’s what you need to know.
Windows Defender Application Control Bypass
You might not have heard of Windows Defender Application Control, so let’s briefly explain what it does. In fact, let Microsoft explain: it is designed to protect devices against malware and other untrusted software. “It prevents malicious code from running by ensuring that only approved code, that you know, can be run,” Microsoft said. In other words, it’s a software-based security layer enforcing a list of specific software that is trusted enough to be allowed to run on your PC. It’s also what is known as a security boundary and eligible for Microsoft bug bounty payments if it can be bypassed. This means, dear reader, there are a lot of hackers’ eyes on the thing, and one of them just found a way to do precisely that: bypass Windows Defender Application Control.
Bobby Cooke, a red team operator working at IBM X-Force Red, or an elite hacker for want of a better definition, has confirmed that the Microsoft Teams application was “a viable WDAC bypass” target and, “when encountering WDAC during Red Team Operations, we successfully bypassed it and executed our Stage 2 Command and Control payload.” Uh oh Buck, bedoop, bedoop, bedoop.
The Windows Defender Bypass Methodology
Hackers are ingenious and obsessive when it comes to finding new attack methods and points of entry. So it should come as no surprise to learn that when hunting for a new execution chain to be used as preparation for a forthcoming financial sector client red team operation, Cooke looked to Windows Defender Application Control, and in particular, Electron applications. “Electron applications function as web browsers that render desktop applications using standard web technologies like HTML, JavaScript and CSS,” Cooke said. What’s more, the JavaScript engine used is something called Node.js, and that provides for the use of a powerful application programming interface. They are powerful because they are capable of interacting with the host operating system. “These APIs allow actions such as reading and writing files, executing programs and other operations typical of native applications,” Cooke explained.
So Cooke pivoted to the legacy Microsoft Teams application, originally built on Electron and signed by Microsoft, which was capable of bypassing even the strictest WDAC policies. “While Node.js can interact with the operating system through its APIs,” Cooke said, “it lacks the full functionality of C, where developers can directly call WINAPIs and NTAPIs.” But that gap is bridged by Node modules which can extend the capabilities of the Node.js framework and execute JavaScript within Electron applications.
What Are LOLBINS?
I think my favorite explanation of what a LOLBIN is came from Naeem Rizwan Mirza, writing at the Emsisoft blog, who used the analogy of breaking into a house without setting the alarm off by using a spare key. “The key belongs to the house and is typically used by its owner,” Mirza said, “so security systems do not flag anything unusual.”
A LOLBIN attack uses perfectly legitimate tools, those already built into the operating system, so they can be exploited without setting off the alarm either. Of course, that tool has been manipulated by the attacker, and so is not actually what it seems. To be accepted as a LOLBIN, sometimes just called a LOL, although that’s a bit confusing and not at all funny, that binary, or library, has to be a system default that can be repurposed by the attacker in question. The end results are as varied as they are capacious: payload obfuscation, code compiling and even execution, DLL hijacking, and, of course, security protection evasion.
As CrowdStrike helpfully pointed out, LOLBIN attacks are increasingly popular for many reasons, but in particular:
- The vehicles used to drive LOLBIN attacks are often to be found in the victim network allow list, such as PowerShell, for example, “which makes for a perfect cover for adversaries as they carry out malicious activity.”
- LOLBINs are sometimes referred to as fileless attacks because, guess what, they do not use files or signatures. This is a supremely clever tactic from the cybercriminal perspective as it means you simply cannot compare or connect such attacks easily, and that results in criminal reuse being much easier as a result.
- CrowdStrike also said that the lack of attack signature means it is much harder to attribute threat campaigns that deploy LOLBINs, “thus fueling the attack cycle.”
- And finally, there’s the fact they enable attackers to enjoy lengthy and undisturbed dwell times while a sophisticated attack is carried out. “By the time the victim is aware of the issue,” CrowdStrike concluded, “there is often little time to effectively respond.”
When it comes to LOLBIN attack mitigation, Mirza warned that a multi-layered approach is essential, and one which focuses on “combining proactive measures, detection capabilities, and incident response strategies.” Endpoint detection and response can help by providing much-needed visibility into everything from command line execution to network connections, Mirza said, which means it can be possible to “catch those unusual uses of LOLBINS and connect the dots with other suspicious events.” Although I might argue that such protections are the embodiment of security basics, Mirza reminded us that the more commonly regarded basics of good security hygiene cannot be overlooked when it comes to LOLBIN attack mitigation. By which we are talking about patch management to ensure all vulnerabilities are fixed in good time before they can be exploited, for example. Threat intelligence also fits my interpretation of basics because unless you know what you are defending against, you are always going to be on the back foot. And finally, Mirza said, you need an incident response plan. “This is your playbook for what to do if an attack happens,” Mirza explained.“It outlines the steps for detection, containment, eradication, and recovery — it’s like having a fire drill so everyone knows what to do in an emergency.”
Windows Defender Attack Flow Using LOLBINS
You should go and read the full report, which is highly technical and seriously useful for any security defenders, for all the attack details, as it’s way too complex to cover here. However, the TL;DR when it comes to the techniques used by the X-Force red team hackers to be able to bypass the Windows Defender security controls and execute the payload is as follows:
- Used a known “Living Off The Land Binaries” method. LOLBINS can hide malicious activity within a known and pre-installed Windows system binary, such as MSBuild.exe.
- Side-loaded a trusted application with an untrusted dynamic linked library.
- Exploited a custom exclusion rule from a client WDAC policy.
- Found a new execution chain in a trusted application to allow the C2 deployment.
Mitigating number one requires the client to have implemented the recommended block list rules, or to be using another solution that can detect the most common LOLBINs.
Mitigating number two is only effective if Windows Defender Application Control is enabled without enforcing DLL signing.
I contacted Microsoft regarding the Windows Defender Application Control bypass, and a spokesperson said, “We are aware of this report and will take action as needed to help keep customers protected.”