Indicator Removal × Microsoft Defender

attackers can remotely delete legitimate files by inserting malware byte signatures into them, causing false-positive detections

Attackers embed known malware byte signatures into benign files (e.g., databases, VMs) via user inputs like website registrations or comments. The EDR/AV scans the file, matches the signature, and deletes or quarantines the file as a false positive, causing denial of service. The technique defeats the security product's own detection logic, not a bypass of detection, but an abuse of it.

Monitor for anomalous file deletion events originating from security product processes (e.g., MsMpEng.exe, avp.exe) targeting non-malicious file types like databases or VM images. Correlate with user input channels (web forms, comments) to detect injection of known malware signatures; mitigate by applying vendor patches and implementing application-level input validation to strip binary signatures from user-supplied content.