# CVE-2024-21338: Microsoft Defender Zero-Day Exploited by Lazarus

> Microsoft patches two zero-day vulnerabilities in Defender and SmartScreen exploited by Lazarus Group for privilege escalation and malware delivery.

- Published: 2026-05-21T09:15:26.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2024-21338, CVE-2024-21412, Lazarus Group, Microsoft Defender, Zero-Day
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-new-defender-zero-days-exploited-in-attacks/
- Canonical: https://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarus

## Key points

- Threat actors are exploiting kernel vulnerabilities in Microsoft Defender to disable security software and elevate system privileges to the highest levels.
- Affected systems include various Windows versions where the appid.sys driver or SmartScreen services are present and unpatched.
- Administrators must apply the February 2024 security updates immediately to protect against active exploitation of these vulnerabilities.

## Overview of Defender Zero-Day Exploitation

Microsoft has released security patches addressing two vulnerabilities within the Windows ecosystem that have been actively exploited as a [Zero-Day](/glossary#zero-day) in the wild. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/microsoft-warns-of-new-defender-zero-days-exploited-in-attacks/), these flaws allowed threat actors to bypass security warnings and gain elevated privileges on targeted systems. The primary [CVE](/glossary#cve) under scrutiny, [CVE-2024-21338](/cve/cve-2024-21338), is a [Privilege Escalation](/glossary#privilege-escalation) vulnerability in the Windows Kernel-Mode Driver (specifically `appid.sys`), while [CVE-2024-21412](/cve/cve-2024-21412) involves a security feature bypass related to Internet Shortcut files.

The exploitation of these vulnerabilities highlights a sophisticated [TTP](/glossary#ttp) used by advanced persistent threats to undermine system integrity. When successfully exploited, these flaws allow attackers to transition from a low-privilege environment to SYSTEM-level access, effectively neutralizing [EDR](/glossary#edr) solutions and other security monitoring tools. This report provides a technical breakdown of the vulnerabilities and the necessary steps for remediation.

## Technical Analysis: CVE-2024-21338 and CVE-2024-21412

### Microsoft Defender kernel driver vulnerability

The most significant of the two disclosures is CVE-2024-21338, which carries a [CVSS](/glossary#cvss) score of 7.8. This flaw resides in the `appid.sys` driver, which is associated with AppLocker. The [Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group), a North Korean [APT](/glossary#apt), has been identified as the primary threat actor utilizing this vulnerability. By exploiting a lack of proper input validation in the driver, the attackers can perform arbitrary memory read/write operations.

This specific exploitation falls under the "Bring Your Own Vulnerable Driver" category, though in this case, the vulnerability existed within a native, trusted Windows driver already present on the system. This makes the attack harder to detect by traditional [SOC](/glossary#soc) monitoring, as the driver is digitally signed by Microsoft. Once the attacker achieves kernel-level access, they can terminate security processes and hide their presence, facilitating further [Lateral Movement](/glossary#lateral-movement) within the network.

### Lazarus Group exploitation of CVE-2024-21412

CVE-2024-21412 represents a bypass of the Mark-of-the-Web (MotW) security feature. This vulnerability is often leveraged during the initial access phase of an attack, frequently delivered via [Phishing](/glossary#phishing) campaigns. By crafting a malicious `.url` file that points to another shortcut file on a remote share, attackers can trick Windows into executing the payload without displaying the standard security warnings that inform users the file originated from the internet.

Security researchers observed this bypass being used to deliver the DarkMe malware. The combination of an initial bypass (CVE-2024-21412) followed by a kernel-level privilege escalation (CVE-2024-21338) creates a highly effective infection chain. The [MITRE ATT&CK](/glossary#mitre-att-ck) framework classifies these actions under techniques such as Exploitation for Privilege Escalation (T1068) and Impair Defenses (T1562).

## Detection and Mitigation Strategies

To defend against these threats, organizations must move beyond simple patch management and implement multi-layered detection. Defending against kernel-level threats requires deep visibility into system calls and driver behavior.

### How to detect CVE-2024-21338 exploit

Security teams can identify potential exploitation attempts by monitoring for unusual activity related to the `appid.sys` driver. Specifically, look for processes that are not part of the standard Windows boot sequence or AppLocker management attempting to communicate with the driver's IOCTL (Input/Output Control) codes. Organizations should configure their [SIEM](/glossary#siem) to alert on unexpected privilege transitions where a user process suddenly gains SYSTEM context without a corresponding valid service start event.

Key [IoC](/glossary#ioc) indicators include:
- Unexpected termination of EDR or antivirus service processes.
- Presence of modified or replaced system drivers in `%SystemRoot%\System32\drivers`.
- Network traffic to known [C2](/glossary#c2) infrastructure following the opening of suspicious shortcut files.

### Remediation and Patching

The most effective mitigation is the immediate application of the Microsoft February 2024 cumulative updates. These updates contain the necessary logic to prevent the unauthorized IOCTL calls in the kernel driver and fix the shortcut file processing logic. Furthermore, organizations should adopt a [Zero Trust](/glossary#zero-trust) architecture, ensuring that even if an attacker gains initial access, their ability to move through the network and escalate privileges is severely limited by strict access controls and micro-segmentation.

**Related:** [CVE-2024-21412: Microsoft Defender Zero-Day Exploitation and Analysis](/blog/cve-2024-21412-microsoft-defender-zero-day-exploitation-and-analysis), [Windows Kernel LPE CVE-2024-21338: Lazarus Group Exploits Zero-Day](/blog/windows-kernel-lpe-cve-2024-21338-lazarus-group-exploits-zero-day)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarus