Windows Defender Leaving the Door WIDE OPEN

Why It Matters

The flaws let adversaries gain full system control and blind security monitoring despite up‑to‑date patches, exposing a critical weakness in the default Windows endpoint protection stack.

Key Takeaways

• RedSun writes malicious payload to System32 using Defender's cloud‑tag routine
• UnDefend blocks signature updates and fakes healthy status on EDR dashboards
• Both exploits work on fully patched Windows 10, 11, Server 2019+
• Attack chain begins with compromised VPN lacking MFA, then drops exploits
• No CVE assigned; Microsoft has not yet released a fix

Pulse Analysis

The emergence of RedSun and UnDefend underscores a rare but alarming scenario where native antivirus software becomes the delivery mechanism for a compromise. RedSun exploits a design quirk in Defender’s cloud‑tag handling, hijacking a privileged write to System32 and masquerading the malicious file as a legitimate service binary. UnDefend, by contrast, silently disables signature updates and feeds false‑positive health data to centralized dashboards, effectively rendering traditional endpoint detection blind. Together, they demonstrate that even fully patched Windows environments are vulnerable when core security components are subverted.

For enterprises, the attack chain highlights two systemic gaps: weak VPN hygiene and overreliance on a single security layer. Huntress Labs traced initial access to VPN accounts lacking multi‑factor authentication, a common misconfiguration that grants attackers the foothold needed to drop the exploits. Once inside, the attackers use innocuous‑looking files in user‑writable directories, bypassing many application‑control policies. The ability of UnDefend to falsify EDR status means security teams may remain unaware of the breach until lateral movement or data exfiltration occurs, eroding trust in automated monitoring tools.

Mitigation now requires a defense‑in‑depth approach. Organizations should enforce MFA on all remote access points, restrict execution from typical staging folders via AppLocker or Windows Defender Application Control, and deploy a secondary endpoint solution that operates independently of Defender’s architecture. Monitoring for anomalous Cloud Files API calls, unexpected changes to TieringEngineService.exe, and stale Defender signature timestamps can provide early indicators. While Microsoft has yet to issue a dedicated patch, staying vigilant on the Microsoft Security Update Guide and applying all interim updates remains essential to limit exposure.