Quickpost: Downloading Files With Windows Defender & User Agent String

Malware Analysis
1

@mohammadaskar2 found out you can use Windows Defender to download arbitrary files. Like this:

"c:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\mpcmdrun.exe" -DownloadFile -url http://didierstevens.com/index.html -path test.html

This command uses MpCommunication as User Agent String:

Quickpost info

Article Link: https://blog.didierstevens.com/2020/09/09/quickpost-downloading-files-with-windows-defender-user-agent-string/