Low
CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Microsoft Defender Remote Code Execution Vulnerability
Add Assessment
Ratings
-
Attacker ValueLow
-
ExploitabilityVery Low
Technical Analysis
No useful information has been published so far and most of the speculations found online are based on the CVSS 3.0 metrics found in the advisory. That said, the attack vector seems to be Local but can be exploited remotely, which means that some kind of malicious file needs to be placed locally to be scanned by Windows Defender and trigger the vulnerability. After talking about this with @smcintyre-r7 and @bwatters-r7, we can imagine that Remote
means this file needs to be sent remotely somehow, for example, using a file upload in a website or an email attachment via Exchange.
Some considerations to keep in mind: Windows defender vulnerabilities get patched immediately and automatically, without user interactions. So, the exploitation window is very short. Finally, even if the exploitation succeeds, the evasion will be problematic, since the anti-virus will probably detect the attack.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportTechnical Analysis
Seeing more evidence of people trying to exploit this in the wild in recent days, with samples such as the ones listed at https://twitter.com/dnpushme/status/1350022293464907780 being detected as CVE-2021-1647 exploit files per VirusTotal analysis.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- security essentials -,
- system center endpoint protection -,
- system center endpoint protection 2012,
- windows defender -
Exploited in the Wild
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportWould you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: