[+] Credits: John Page (aka hyp3rlinx)		
[+] Website:
[+] Source:
[+] ISR: ApparitionSec     


Windows Defender

[Vulnerability Type]
Windows Defender Detection Mitigation Bypass

[CVE Reference]

[Security Issue]
Trojan.Win32/Powessere.G / Mitigation Bypass Part 2.

Typically, Windows Defender detects and prevents TrojanWin32Powessere.G aka "POWERLIKS" type execution that leverages rundll32.exe. Attempts at execution fail
and attackers will typically get an "Access is denied" error message.

Back in 2022, I disclosed how that could be easily bypassed by passing an extra path traversal when referencing mshtml but since has been mitigated.
However, I discovered using multi-commas "," will bypass that mitigation and successfully execute as of the time of this writing.


Open command prompt as Administator.

C:\sec>rundll32.exe javascript:"\..\..\mshtml,RunHTMLApplication ";alert(666)
Access is denied.

C:\sec>rundll32.exe javascript:"\..\..\mshtml,,RunHTMLApplication ";alert(666)

Multi-commas, for the Win!

[Network Access]


[Disclosure Timeline]
February 7, 2024: Public Disclosure