Thursday, December 7, 2023

Vulnerability in Windows Defender Application Control Let Hackers Bypass It’s Security Feature

Microsoft released a new security update for the vulnerability that affected Windows Defender Application Control (WDAC) that allows a local attacker to bypass the WDAC security feature.

Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.

WDAC also block unsigned scripts and MSIs, and Windows PowerShell runs in Constrained Language Mode.

According to Microsoft advisory, An attacker who successfully exploited this vulnerability could circumvent PowerShell Core Constrained Language Mode on the machine.

In order to exploit this vulnerability, the Attacker first gains administrator access to the local machine where PowerShell is running in Constrained Language mode which leads an attacker leverage script debugging to abuse signed modules and access resources in an unintended way.

The vulnerability affects PowerShell Core prior to the following versions:

PowerShell Core VersionFixed in
6.16.1.5
6.26.2.2

If you want to check whether the system is vulnerable follow the below instruction that suggested here,

  1. Run pwsh -v, then, check the version in the table in Affected Software to see if your version of PowerShell Core is affected.
  2. If you are running a version of PowerShell Core where the executable is not pwsh or pwsh.exe, then you are affected. This only existed for a preview version of 6.0.

If you find that your system running with an affected version, you can download the latest version here at PowerShell Core Releases page.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read

New Adwind RAT Attack Linux, Windows and Mac via DDE Code Injection Technique by Evading Antivirus Software

Hackers Spreading New Malware with Powerful Obfuscation Technique to Bypass Antivirus Software

Website

Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles