New DefenderWrite Tool Let Attackers Inject Malicious DLLs into AV Executable Folders

DefenderWrite is a proof-of-concept tool that enumerates whitelisted Windows executables and uses process creation plus remote DLL injection to write arbitrary files into antivirus installation folders, enabling potential persistence and scan evasion. The report documents lab tests on Windows 11 with Microsoft Defender and notes similar findings in other AV products, provides usage parameters and automation scripts, and links to the public GitHub repository while emphasizing ethical testing.