Break The Protective Shell Of Windows Defender With The Fold...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html
• Blog Title: Break The Protective Shell Of Windows Defender With The Folder Redirect Technique
• Suggested Section: Windows -> AV/EDR Evasion -> Windows Defender tampering (Platform version-folder symlink hijack / DLL sideloading)

🎯 Content Summary

What the post shows: A deterministic way to hijack Windows Defender’s execution folder by abusing its versioned update/selection logic and a directory symbolic link placed under ProgramData\Microsoft\Windows Defender\Platform. This lets an admin make WinDefend run from an attacker-writable path, enabling DLL sideloading or outright disabling Defender by breaking the link.

How Defender chooses its binaries (observed with

Code execution via DLL sideloading from the hijacked directory: Once Defender executes from the attacker-controlled folder, drop/replace DLLs expected to be loaded from the application directory to achieve code execution inside Defender’s processes (classic sideloading pattern leveraging LoadLibrary search order).

Persistent Defender disablement by breaking the redirected path: After redirection, remove ...

🤖 Agent Actions

I analyzed the repository and found the most relevant location for this Windows Defender tampering technique is the consolidated Windows AV/EDR evasion page:

• src/windows-hardening/av-bypass.md

That page already covers Defender-related tampering concepts (including a PPL-based tamper approach) and DLL sideloading, so it’s the right place to add a new section about the Platform version-folder symlink hijack.

What I added:

• A new section: “Tampering Microsoft Defender via Platform Version Folder Symlink Hijack” with:
  • Clear explanation of Defender’s versioned-folder selection behavior
  • Preconditions (admin, reboot trigger)
  • Why it works (trusting highest version entry including symlinks)
  • Step-by-step procedure with commands:
    • Cloning current platform folder
    • mklink /D creation under ProgramData to a higher lexical version name
    • Reboot
    • Verification commands (PowerShell Get-Process MsMpEng | Select Path, WMI)
  • Post-exploitation options (DLL sideloading leveraging the existing “DLL Sideloading & Proxying” section, service disruption by removing the symlink)
  • Detection ideas (symlink/reparse point creation under Platform, Defender executing from non-standard path)
  • Hardening tips (WDAC/AppLocker, path validation, Tamper Protection)
• References updated with:
  • The Zero Salarium blog post
  • Microsoft mklink docs
  • Procmon reference is already present on the page

Changes implemented:

• Modified file: src/windows-hardening/av-bypass.md
• Inserted the new section just before the existing References and fixed a minor typo in an existing command.

No new file was required because the content integrates naturally with the current AV bypass page and leverages existing sections (e.g., DLL sideloading) for cross-referencing.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html

Content Categories: Based on the analysis, this content was categorized under "Windows -> AV/EDR Evasion -> Windows Defender tampering (Platform version-folder symlink hijack / DLL sideloading)".

Repository Maintenance:

• MD Files Formatting: 876 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0