Essential flaws uncovered within the community communication between Microsoft Defender for Endpoint (DFE) and its cloud companies, permitting post-breach attackers to bypass authentication, spoof knowledge, disclose delicate data, and even add malicious information to investigation packages.
These vulnerabilities, detailed in a latest evaluation by InfoGuard Labs, spotlight ongoing dangers in endpoint detection and response (EDR) methods, doubtlessly undermining incident response efforts.
Reported to Microsoft’s Safety Response Heart (MSRC) in July 2025, the problems had been deemed low severity, with no fixes confirmed as of October 2025.
The analysis builds on prior explorations of EDR assault surfaces, specializing in the agent’s interplay with cloud backends. By intercepting visitors utilizing instruments like Burp Suite and bypassing certificates pinning by way of reminiscence patches in WinDbg, the evaluation revealed how DFE’s MsSense.exe course of handles instructions and knowledge uploads.
Certificates pinning, a typical safety measure, was circumvented by altering the CRYPT32!CertVerifyCertificateChainPolicy perform to at all times return a legitimate consequence, enabling plaintext inspection of HTTPS visitors.
Related patches had been utilized to SenseIR.exe for full interception, together with Azure Blob uploads.
Azure Add
Authentication Bypasses and Command Interception
In accordance with InfoGuard Labs the core problem lies within the agent’s requests to endpoints like https://[location-specific-host]/edr/instructions/cnc, the place it polls for instructions corresponding to isolation, forensics assortment, or scans.
Regardless of together with Authorization tokens and Msadeviceticket headers, the backend ignores them solely. An attacker with the machine ID and tenant ID simply obtainable by low-privileged customers by way of registry reads can impersonate the agent and intercept responses.
For example, an intruder device like Burp’s Intruder can constantly question the endpoint, snatching accessible instructions earlier than the legit agent receives them.
This permits spoofing responses, corresponding to faking an “Already remoted” standing for an isolationcommand, leaving the system unisolated whereas the Microsoft Defender Portal studies it as secured.
The serialization format, typically in Microsoft Bond, complicates guide crafting, however capturing and modifying legit responses suffices for proof-of-concept exploits.
A parallel vulnerability impacts /senseir/v1/actions/ endpoints for Stay Response and Automated Investigations. Right here, CloudLR tokens are equally ignored, obtainable with out authentication utilizing simply the machine ID.
Attackers can decode motion payloads with customized scripts leveraging massive language fashions for Bond deserialization and add fabricated knowledge to offered Azure Blob URIs by way of SAS tokens, which stay legitimate for months.
Data Disclosure and Malicious File Dangers
Unauthenticated entry extends to incident response (IR) exclusions by way of the registration endpoint, requiring solely the group ID from the registry.
Extra alarmingly, polling /edr/instructions/cnc with out credentials yields an 8MB configuration dump, together with RegistryMonitoringConfiguration, DriverReadWriteAccessProcessList, and ASR guidelines. Whereas not tenant-specific, this knowledge reveals detection logic useful for evasion.
Publish-breach, attackers can enumerate investigation packages on the filesystem, readable by any consumer, containing autoruns, put in applications, and community connections.
For ongoing investigations, spoofed uploads to those packages allow embedding malicious information with innocuous names, tricking analysts into execution throughout evaluation.
These flaws underscore the challenges in securing EDR communications, the place easy oversights persist regardless of a number of token sorts. The analyst urges remediation, arguing that post-breach disruption and analyst-targeted assaults benefit a better precedence than MSRC’s evaluation.
Comply with us on Google Information, LinkedIn, and X for day by day cybersecurity updates. Contact us to characteristic your tales.
