Microsoft released a security update to address CVE-2022-23278 in Microsoft Defender for Endpoint. This important class spoofing vulnerability impacts all platforms. We wish to thank Falcon Force for the collaboration on addressing this issue through coordinated vulnerability disclosure.

Cybercriminals are looking for any opening to tamper with security protections in order to blind, confuse, or often shut off customer defenses. Microsoft continuously works to defeat these methods to help our customers protect their environment and gain visibility when attacks occur, both through our own research and in partnership with the security community. With our March security update release, we are further hardening Microsoft Defender for Endpoint by addressing the ability for attackers to spoof information between the client and the service. This vulnerability impacts all platforms and the updates we have released should be deployed just like any other security update. On Windows, this is part of the March Cumulative Update for Windows so if automatic updates are scheduled, no further action is necessary. For those who do not have automatic updates turned on, we recommend doing so. Customers using the latest operating systems benefit from new operating system capabilities that allow strong protections. Instructions for the normal deployment method are below:

At time of publication, Microsoft is not aware of any attacks that have leveraged this vulnerability. In addition to the security update, Microsoft has released detections for possible exploit activity. Customers should monitor for those detections (list below) and consult the threat analytics article (requires license and access) which surfaces risk and possible exploit activity.

• Suspicious client communication – detects suspicious client communication which could either be caused by device spoofing or duplicate device IDs.

Customers are encouraged to apply the March security updates as soon as possible. Official documentation on the updates can be found here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23278.

- Microsoft Defender for Endpoint Team