Windows Defender Exploits Turn Security Tool into Attacker Asset

Three proof-of-concept exploits are currently being used in active attacks to subvert Microsoft Windows Defender. Two of these exploits remain unpatched, allowing attackers to bypass security controls or use Defender's own processes to execute malicious code. This 'Living-off-the-Land' (LotL) technique significantly complicates detection for SOC teams. [Sources: DarkReading]