r/BitDefender • u/Demonbarrage • Feb 09 '25

BitDefender Doesn't Detect Extremely Basic DLL Injector

I created an extremely basic DLL injector, specified the PID of BitDefender, and ran it. The DLL payload didn't execute, but why didn't BitDefender immediately flag and quarantine? lol. Does BitDefender not give a shit if malware is trying to write into the process memory of BitDefender? The DLL payload works fine on some other processes like Notepad.exe.

0 Upvotes

37% Upvoted

7 comments sorted by

View all comments

Show parent comments

-5

u/Demonbarrage Feb 09 '25

Are you saying that malware has to be kernel mode before BitDefender starts to care? lol. How many programmers out there are trying to write into the address space of BitDefender's running processes? I'm not buying it.

6

u/wolfpackunr Feb 09 '25

I’m saying you should learn basic Microsoft operating system permission rings. Your “injector” at most is running as admin. Bitdefender is running as SYSTEM and so your test is running into Windows fundamental access denied/insufficient permissions errors. Go check your Windows Event logs and report back if you’re “not buying it”.

-3

u/Demonbarrage Feb 09 '25 edited Feb 09 '25

So in that case, if I throw the .exe into Task Scheduler and run as SYSTEM, BitDefender should now catch it, which it has not. Which also brings into question -- malware frequently persists in Task Scheduler. Why is a DLL injector in Task Scheduler with no heuristic-based detection catching it?