Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Microsoft Defender Zero Day Vulnerability and FIX

Microsoft Defender Zero Day Vulnerability and FIX

Written By Gopika S Nair
Last Updated February 15, 2024
SHARE

Let’s discuss Microsoft Defender Zero Day Vulnerability and FIX. Microsoft patched the vulnerability of Microsoft Defender SmartScreen. Microsoft Defender has been affected by a critical issue recently, and it was patched in the February 2024 Patch Tuesday.

Patch Tuesday is a technical term used to refer to regularly releasing software patches of Microsoft, Oracle, etc. On Patch Tuesday, Microsoft always introduces new improvements, bug fixes, etc. The critical vulnerabilities are fixed in the Patch Tuesday day, announced as a Zero Day Vulnerability.

Microsoft Defender is a security solution that helps protect Windows devices from various threats, including zero-day vulnerabilities. Remember that addressing zero-day vulnerabilities promptly is crucial to maintaining the security of your systems.

Tracked as Water Hydra and DarkCasino hacking groups try to exploit a zero-day vulnerability (CVE-2024-21412) in attacks on New Year’s Eve day Windows Defender SmartScreen. Trend Micro security researchers identified this exploitation of hackers.

Patch My PC

The hackers try to attack crypto traders with malware. Microsoft explained this attack as an unauthenticated attacker “could send the targeted user a specially crafted file designed to bypass displayed security check Microsoft Defender Zero Day Vulnerability and FIXs.” This blog post details Microsoft Defender Zero Day Vulnerability and FIX.

Microsoft Defender Zero Day Vulnerability and FIX

Microsoft Windows Defender SmartScreen doesn’t correctly apply marks of the web when using shortcut files, which essentially leads to a bypass of the intelligent screen protections. The attack against Microsoft Defender is detected on December 30th.

The security researchers are tracking another security bypass vulnerability, CVE, and notified Microsoft immediately. Trend Micro can roll out protection to customers in January.

CVE NumberCVE NumberPublicly DisclosedExploitability assessmentExploited
CVE-2024-21412Internet Shortcut Files Security Feature Bypass VulnerabilityNoExploitation DetectedYes
Microsoft Defender Zero Day Vulnerability and FIX – Table.1
Microsoft Defender Zero Day Vulnerability and FIX - Fig.1
Microsoft Defender Zero Day Vulnerability and FIX – Fig.1

Microsoft Protection of Customers from Malware

Mark of the web is a security feature that helps us when we download content from the internet. Since there is a lot of malicious content on the internet, we want to ensure we don’t inadvertently click on something malicious.

It’s a feature that Microsoft has in place: if you download something from an untrusted source, it will get a mark of the web designation, forcing you to make a conscious decision on executing this file.

How could an Attacker Exploit the Vulnerability?

An unauthenticated attacker could send the targeted user a specially crafted file that is designed to bypass displayed security checks. However, the attacker would have no way to force a user to view the attacker-controlled content. Instead, the attacker would have to convince them to take action by clicking on the file link.

With zero-day being the new constant, organizations must defend and protect themselves, paying special attention to the user applications as most of the Defender zero day vulnerability out there fall within this environment.

To get more updates about the device management solutions, Please follow the HTMD Community and visit our website HTMD Forum, to keep up with our expert coverage. Also, follow us at X, @HTMDCommunity for the latest news and updates.

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Gopika S Nair is a computer enthusiast. She loves writing on Windows 11 and related technologies. She is here to share quick tips and tricks with Windows 11 or Windows 10 users. She is Post Graduate Diploma Holder in Computer Science.

Written by

Gopika S Nair is a computer enthusiast. She loves writing on Windows 11 and related technologies. She is here to share quick tips and tricks with Windows 11 or Windows 10 users. She is Post Graduate Diploma Holder in Computers Science.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint EDR Updates are now Separate from Monthly Windows Security Updates for Faster Protection

Key Takeaways In this post, we are discussing how Microsoft Defender for Endpoint EDR Updates Will Be Delivered Through Microsoft Update. Microsoft has introduced a new update model for Microsoft Defender for Endpoint Detection and Response (EDR) security updates. Previously, these updates were included with the monthly Windows security updates. This change enables Microsoft to […]

AC Anoop C Nair 5 min read
Microsoft Defender for Endpoint

Microsoft Defender Custom Data Collection Lets You Collect Custom Endpoint Logs Without Extra Agents

Key Takeaways: Let’s discuss about Microsoft Defender Custom Data Collection to Streamlined Telemetry without Extra Agent. Microsoft announced the general availability of Microsoft Defender Custom Data Collection. This feature is simplified collection of logging through the Defender agent itself. Microsoft Defender Custom Data Collection to Streamlined Telemetry without Extra Agent Admins can define which events […]

AC Anoop C Nair 3 min read
Intune

Manage Offline Security Updates for Linux using Microsoft Defender and Intune

Key Takeaways Manage Offline Security Updates for Linux using Microsoft Defender and Intune! Microsoft now allows admins to manage offline security intelligence updates for Linux devices directly from the Defender and Intune portals. Admins can configure how Linux devices receive Defender security updates without using manual command-line configurations on each device. Configure Offline Security Intelligence […]

AC Anoop C Nair 3 min read
Microsoft Defender for Endpoint

New Selective Response Actions Improve Safer Device Onboarding in Microsoft Defender for Endpoint

Key Takeaways Selective Response Actions is a new Preview feature in Microsoft Defender for Endpoint that gives organizations better control over security response actions during device onboarding. It helps IT and security teams apply high-impact actions more carefully on Tier-0 systems and other important devices, improving protection while maintaining operational stability. New Selective Response Actions […]

AC Anoop C Nair 3 min read