DEFENDERWRITE: ABUSING WHITELISTED PROGRAMS FOR ARBITRARY WRITES

Summary from the TLDR InfoSec newsletter

Antivirus folders typically block file writes to prevent attacks, but some whitelisted Windows programs can bypass these restrictions. DefenderWrite is a tool that identifies which executables can write files into protected antivirus folders without elevated privileges or exploits. By scanning all .exe files and testing their capabilities, the tool reveals weak points in Windows Defender and other major AVs, showing that even protected folders can be compromised for stealthy persistence.