Microsoft Defender 'ShieldCrash' Unpatched Privilege Escalation — Detection and Mitigation Guide

---
title: Microsoft Defender Engine Spawning Suspicious Child Process
id: 9b1c4d7e-2f3a-4b5c-8d6e-7f8a9b0c1d2e
status: experimental
description: Detects the Microsoft Defender antimalware engine (MsMpEng.exe) spawning command interpreters, scripting hosts, or LOLBins. This behavior is abnormal for the Defender engine and is consistent with post-exploitation of a Defender privilege escalation flaw such as ShieldCrash, where attacker code executes in the context of the SYSTEM-privileged engine.
references:
  - https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\MsMpEng.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Defender remediation actions may invoke system tools in tightly controlled scenarios. Validate command line and parent version path against expected Defender platform version.
level: high
---
title: Non-System Write to Microsoft Defender Platform Directory
id: 3e5f7a9b-1c2d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects file creation or modification inside Microsoft Defender platform or signature directories by processes running outside the expected Defender service context. Manipulation of these paths by a standard user is consistent with pre-exploitation staging for AV privilege escalation vulnerabilities such as ShieldCrash (insecure filesystem operations, link following, or planted binaries consumed by the SYSTEM engine).
references:
  - https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
  - attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows Defender\Platform\'
      - '\ProgramData\Microsoft\Windows Defender\Definition Updates\'
      - '\Program Files\Windows Defender\'
  filter_legit:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'
      - '\MpSigStub.exe'
      - '\MsSense.exe'
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'
      - '\svchost.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Windows Update servicing operations using unexpected service binaries; verify signer and process ancestry before tuning.
level: high
---
title: Microsoft Defender Tampering or Unexpected Service Disablement
id: 7c8d9e0f-1a2b-4c3d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects attempts to stop, disable, or modify the Microsoft Defender Antivirus service (WinDefend) or its tamper-protection related registry configuration. Privilege escalation via ShieldCrash enables SYSTEM-level tampering with Defender itself; these actions are a strong post-exploitation indicator.
references:
  - https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'WinDefend'
  selection_reg:
    CommandLine|contains:
      - 'Windows Defender\Real-Time Protection'
      - 'Windows Defender\Features'
      - 'DisableAntiSpyware'
      - 'DisableAntiVirus'
      - 'DisableRealtimeMonitoring'
  condition: selection_sc or selection_reg
falsepositives:
  - Managed AV migration scripts and enterprise software deployment tools. Allowlist known deployment tooling and management accounts.
level: high

// Hunt 1: Defender engine spawning unexpected child processes (post-exploitation as SYSTEM)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","bitsadmin.exe","certutil.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
| order by TimeGenerated desc;

// Hunt 2: Non-SYSTEM / unexpected process writing into Defender platform or signature paths
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\ProgramData\\Microsoft\\Windows Defender\\Platform\\", "\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", "\\Program Files\\Windows Defender\\")
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe","MpCmdRun.exe","MpSigStub.exe","MsSense.exe","TiWorker.exe","TrustedInstaller.exe","svchost.exe","system")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType
| order by TimeGenerated desc;

// Hunt 3: Defender service tampering attempts following local escalation
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("WinDefend", "DisableAntiSpyware", "DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "Set-MpPreference")
| where InitiatingProcessAccountName !in~ ("system", "local service", "network service")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

-- Hunt for ShieldCrash-style post-exploitation artifacts:
-- 1) Suspicious child processes spawned by the Defender engine (MsMpEng.exe)
-- 2) Recent unexpected file modifications inside Defender platform directories

LET children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist(parent=pslist(name='MsMpEng.exe'))
WHERE Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic)\.exe'

LET defender_files = SELECT FullPath AS DefenderPath, Mtime, Size,
       parse_pe(file=FullPath) AS PEInfo
FROM glob(globs='C:/ProgramData/Microsoft/Windows Defender/Platform/*/*.exe')
WHERE Mtime > now() - 86400 * 3

SELECT * FROM children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'FILE_MOD' AS Name,
       DefenderPath AS CommandLine, NULL AS Exe, NULL AS Username,
       Mtime AS CreateTime
FROM defender_files

# ShieldCrash interim hardening & verification - run as Administrator
$report = [ordered]@{}

# 1) Verify Defender real-time protection and Tamper Protection state
$mp = Get-MpComputerStatus
$report.RealTimeProtectionEnabled = $mp.RealTimeProtectionEnabled
$report.AntispywareEnabled        = $mp.AntispywareEnabled
$report.AntivirusSignatureVersion = $mp.AntivirusSignatureVersion
$report.AMEngineVersion           = $mp.AMEngineVersion
$report.AMProductVersion          = $mp.AMProductVersion
$report.AMServiceEnabled          = $mp.AMServiceEnabled

# Tamper Protection status (via registry; requires admin)
try {
    $tp = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Features' -Name 'TamperProtection' -ErrorAction Stop
    $report.TamperProtectionValue = $tp.TamperProtection   # 5 = enabled, 4 = disabled
} catch {
    $report.TamperProtectionValue = 'Key not found'
}

# 2) Audit ACLs on Defender platform directory for unexpected writable identities
$platformRoot = 'C:\ProgramData\Microsoft\Windows Defender\Platform'
$report.PlatformACLFindings = @()
if (Test-Path $platformRoot) {
    Get-ChildItem $platformRoot -Directory | ForEach-Object {
        $acl = Get-Acl $_.FullName
        $suspect = $acl.Access | Where-Object {
            $_.FileSystemRights -match 'Write|Modify|FullControl' -and
            $_.IdentityReference -match 'Users|Everyone|Authenticated Users|INTERACTIVE'
        }
        if ($suspect) {
            $report.PlatformACLFindings += [pscustomobject]@{
                Path   = $_.FullName
                Access = ($suspect | ForEach-Object { "$($_.IdentityReference):$($_.FileSystemRights)" }) -join '; '
            }
        }
    }
}

# 3) Confirm WinDefend service is running and protected
$svc = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
$report.WinDefendStatus = if ($svc) { $svc.Status.ToString() } else { 'NotFound' }

# 4) Flag recent non-standard files dropped into platform directories (last 72h)
$cutoff = (Get-Date).AddHours(-72)
$report.RecentPlatformFiles = @()
if (Test-Path $platformRoot) {
    $report.RecentPlatformFiles = Get-ChildItem $platformRoot -Recurse -File |
        Where-Object { $_.LastWriteTime -gt $cutoff } |
        Select-Object FullName, LastWriteTime, Length
}

$report | ConvertTo-Json -Depth 5

# 5) Quick health check of MDE service if onboarded
$sense = Get-Service -Name Sense -ErrorAction SilentlyContinue
if ($sense) { Write-Output "MDE Sense service: $($sense.Status)" }