Arbitrary File Download Via ConfigSecurityPolicy.EXE with URL

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.