CVE-2026-33825: Microsoft Defender Access Control Exploitation — Detection and Remediation

---
title: Potential Microsoft Defender ACL Modification
description: Detects attempts to modify Access Control Lists (icacls) on Microsoft Defender directories, indicative of CVE-2026-33825 exploitation or Tamper Protection bypass.
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/04/23
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\icacls.exe'
      - '\xcacls.exe'
    CommandLine|contains:
      - 'ProgramData\\Microsoft\\Windows Defender'
      - 'Program Files\\Windows Defender'
  condition: selection
falsepositives:
  - Legitimate administrator modifying Defender permissions (rare)
level: high
---
title: PowerShell Defender Exclusion Injection
description: Detects the use of PowerShell to add exclusions to Microsoft Defender, a common tactic to bypass AV/EDR after exploiting access control vulnerabilities.
id: b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e
status: experimental
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/04/23
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pow:
    Image|endswith: '\powershell.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Add-MpPreference'
      - 'Set-MpPreference'
  filter_exclusion:
    CommandLine|contains:
      - '-ExclusionPath'
      - '-ExclusionProcess'
  condition: all of selection_* and filter_exclusion
falsepositives:
  - Authorized administration scripts managing Defender policies
level: medium
---
title: Registry Modification of Defender Features
description: Detects modifications to the Windows Defender registry keys often associated with disabling features or altering behavior.
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/04/23
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'SOFTWARE\\Microsoft\\Windows Defender\\Features'
      - 'SOFTWARE\\Microsoft\\Windows Defender\\Policy'
    Details|contains:
      - '0x00000000'
      - 'disable'
level: medium

// Hunt for ACL modifications on Defender directories
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("icacls.exe", "xcacls.exe", "takeown.exe")
| where ProcessCommandLine has_any ("ProgramData\\Microsoft\\Windows Defender", "Program Files\\Windows Defender")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| extend HuntContext = "Potential CVE-2026-33825 Exploitation - ACL Modification"

// Hunt for PowerShell exclusion additions
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "Set-MpPreference" and (ProcessCommandLine contains "-ExclusionPath" or ProcessCommandLine contains "-ExclusionProcess")
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| extend HuntContext = "Potential CVE-2026-33825 Exploitation - Exclusion Injection"

-- Hunt for process execution attempting to modify Defender permissions
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'icacls.exe'
   AND CommandLine =~ 'Windows Defender'

-- Check for unusual ACL modifications on Defender Platform folder
SELECT FullPath, Mode, Size, Mtime
FROM glob(globs='/*
   OR CommandLine =~ 'Program Files\\Windows Defender'

<#
.SYNOPSIS
    Remediation Script for CVE-2026-33825
.DESCRIPTION
    Checks for Microsoft Defender updates, verifies Tamper Protection status,
    and audits the ACLs of critical Defender directories.
#>

Write-Host "Starting CVE-2026-33825 Remediation Checks..." -ForegroundColor Cyan

# 1. Check Microsoft Defender Version and Update Status
Write-Host "\n[+] Checking Defender Engine Version..." -ForegroundColor Yellow
$MpPreference = Get-MpPreference
Write-Host "Current Engine Version: $($MpPreference.EngineVersion)"

# Note: Ensure the specific patch for CVE-2026-33825 is installed via Windows Update.
# As this is a recent CVE, ensure 'Microsoft Update' catalog is checked.
Write-Host "Action: Verify Windows Update (KB specific to CVE-2026-33825) is installed immediately." -ForegroundColor Red

# 2. Verify Tamper Protection is Enabled
Write-Host "\n[+] Checking Tamper Protection Status..." -ForegroundColor Yellow
# Tamper Protection registry key (introduced in newer Win10/11 builds)
$TamperPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
$TamperValue = (Get-ItemProperty -Path $TamperPath -ErrorAction SilentlyContinue).TamperProtection

if ($TamperValue -eq 5) { # 5 usually means Enabled/On
    Write-Host "Tamper Protection: ENABLED (Secure)" -ForegroundColor Green
} else {
    Write-Host "Tamper Protection: DISABLED or NOT SET (VULNERABLE)" -ForegroundColor Red
    Write-Host "Action: Enable Tamper Protection via Intune or Group Policy immediately."
}

# 3. Audit ACLs on Defender Directory (Detect Granularity Issues)
Write-Host "\n[+] Auditing Access Control Lists on Defender Platform Directory..." -ForegroundColor Yellow
$DefenderPath = "$env:ProgramData\Microsoft\Windows Defender\Platform"
if (Test-Path $DefenderPath) {
    $Acl = Get-Acl $DefenderPath
    Write-Host "Owner: $($Acl.Owner)"
    Write-Host "Checking for non-standard write permissions..."
    $Acl.Access | Where-Object { $_.FileSystemRights -match "Write|Modify|FullControl" -and $_.IdentityReference -notmatch "SYSTEM|Administrators|TrustedInstaller" } | Select-Object IdentityReference, FileSystemRights | Format-Table
    Write-Host "Action: If non-admin users/groups have Write/Modify permissions, revert to defaults immediately."
} else {
    Write-Host "Defender Platform path not found."
}

Write-Host "\nRemediation Script Complete." -ForegroundColor Cyan