RedSun turned Defender into a write primitive

Opening position RedSun describes a defect in Windows Defender's remediation pipeline where the act of cleaning a detected file became a primitive for arbitrary writes into protected system locations. The component that exists to remove malicious content was the component that delivered it. The defender became the delivery mechanism. This is not a detection failure. Detection worked. The malicious content was identified, classified, and routed for action. The failure occurred after detection,...