Attackers Exploit Defender for Endpoint Cloud API to Bypass Authentication and Disrupt Incident Response

Attackers can exploit Defender for Endpoint’s cloud API to bypass authentication, intercept commands, and spoof results, potentially derailing incident response and misleading analysts, according to Infoguard’s research cited in the piece. The analysis shows that multiple backend endpoints accept requests without effective token validation, enabling unauthenticated manipulation if a machine ID and tenant ID are known.

It highlights weaknesses in Defender Cloud traffic, where the agent regularly polls /edr/commands/cnc for commands such as isolationcommand and forensicscollectioncommand, yet the backend reportedly ignores the Authorization and Msadeviceticket headers.

An attacker with knowledge of a machine ID and tenant ID can race the agent to retrieve pending commands, upload spoofed telemetry to Azure Blob storage, and pollute evidence, while a parallel flaw affects /senseir/v1/actions/ used for Live Response and Automated Investigation.

The piece notes that Microsoft reportedly classed these issues as low severity and that throttling began in October, with core weaknesses persisting; defenders are urged to monitor unusual CNC polling patterns, verify isolation states, restrict local identifiers, and verify results out-of-band while Microsoft works on backend token validation.