defender_observer

DefenderObserver A C / .NET 9 console tool for capturing, recording, replaying, and analyzing Microsoft Defender Antivirus & EDR ETW telemetry in real-time. For RedTeamers wanting to observe how Defender reacts to their offensive tooling. ETW events captured from: Microsoft-Antimalware-Engine...

Microsoft Malware Protection Engine Denial of Service Bug

Microsoft today released a security advisory alerting users of a serious vulnerability in the antimalware engine present in a number of security products, including Windows Defender, Forefront and others. The update will be automatically pushed down to the Microsoft Malware Protection Engine in t...

Microsoft Security Essentials Support Continues Beyond XP

Microsoft announced yesterday that it plans to continue updating signatures on the antimalware engine it uses to protect Windows XP for more than a year beyond the date from which it plans to cut off support for the operating system. That means enterprises still running System Center Endpoint...

CVE-2012-1453

CVE-2012-1453 affects multiple antivirus products whose CAB file parsers can bypass malware detection when a CAB file’s coffFiles field is modified. Affected vendors/products include Dr.Web 5.0.2.03300; Trend Micro HouseCall 9.120.0.1004; Kaspersky Anti-Virus 7.0.0.125; Sophos Anti-Virus 4.61.0; ...

PT-2012-3268

Name of the Vulnerable Software and Affected Versions ClamAV version 0.96.4 Rising Antivirus version 22.83.00.03 Quick Heal version 11.00 G Data AntiVirus version 21 AVEngine version 20101.3.0.103 in Symantec Endpoint Protection 11 Command Antivirus version 5.2.11.5 Ikarus Virus Utilities T3...