RoguePlanet Microsoft Defender Zero-Day: Emergency Detection and Patching Guide

---
title: Microsoft Defender Engine Unexpected Termination - RoguePlanet Indicator
id: a7b3c9d2-4e8f-1a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects unexpected termination of Microsoft Defender processes which may indicate exploitation of RoguePlanet or similar bypass attempts
references:
  - https://www.microsoft.com/security/blog/
author: Security Arsenal
date: 2026/06/20
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\NisSrv.exe'
  filter_legitimate:
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
  condition: selection | count() > 5 by ParentProcessId within 5m
falsepositives:
  - Legitimate Defender service restarts during updates
  - System instability unrelated to attack
level: high
---
title: Suspicious File Creation in Defender Exclusion Paths
id: b8c4d0e3-5f9g-2b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects creation of files in paths often associated with Defender bypass techniques and persistence
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/06/20
tags:
  - attack.persistence
  - attack.t1055
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'C:\ProgramData\Microsoft\Windows Defender\Platform'
      - 'C:\Program Files\Windows Defender'
  filter_legitimate:
    Image|endswith:
      - '\MpCmdRun.exe'
      - '\SenseCE.exe'
      - '\setup.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate Defender updates
level: medium
---
title: Defender Tampering via PowerShell Commands
id: c9d5e1f4-6g0h-3c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects PowerShell commands attempting to disable or modify Microsoft Defender settings consistent with RoguePlanet follow-on activity
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/06/20
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_commands:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'Add-MpPreference'
      - 'ExclusionPath'
      - 'DisableBehaviorMonitor'
  filter_legitimate:
    SubjectUserName|contains:
      - 'Administrator'
      - 'SYSTEM'
      - 'NT AUTHORITY'
  condition: selection_powershell and selection_commands
falsepositives:
  - Authorized administrative changes
  - Legitimate IT management scripts
level: high

// Hunt for RoguePlanet exploitation indicators - Defender process anomalies
let TimeFrame = 1h;
let DefenderProcesses = dynamic(['MsMpEng.exe', 'NisSrv.exe', 'MsMpeng.exe', 'WdNisSvc.exe']);
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ (DefenderProcesses)
| summarize ProcessCount = count(), RestartCount = dcount(ProcessId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, FileName, InitiatingProcessFileName
| where RestartCount > 3
| project DeviceName, FileName, InitiatingProcessFileName, ProcessCount, RestartCount, FirstSeen, LastSeen, RiskScore = RestartCount * 10
| order by RiskScore desc
| extend AlertInfo = strcat('Multiple Defender process restarts detected on ', DeviceName, '. Possible RoguePlanet exploitation attempt.')


// Hunt for suspicious registry modifications to Defender settings
let TimeFrame = 24h;
DeviceRegistryEvents
| where Timestamp > ago(TimeFrame)
| where RegistryKey contains @"SOFTWARE\Microsoft\Windows Defender"
| where RegistryKey contains @"Features" or RegistryKey contains @"Real-Time Protection" or RegistryKey contains @"Spynet"
| where ActionType != "RegistryValueSet" or ActionType != "RegistryKeyCreated"
| summarize count() by DeviceName, RegistryKey, RegistryValueName, InitiatingProcessFileName, InitiatingProcessAccountName
| where count_ > 1
| project DeviceName, RegistryKey, RegistryValueName, InitiatingProcessFileName, InitiatingProcessAccountName, ModificationCount = count_
| order by ModificationCount desc

-- Hunt for RoguePlanet indicators: Defender process instability and suspicious modifications
SELECT 
    Pid, 
    Name, 
    CommandLine, 
    Exe, 
    Username, 
    CreateTime,
    ExitTime
FROM pslist()
WHERE Name =~ 'MsMpEng.exe'
   OR Name =~ 'NisSrv.exe'
   OR Name =~ 'WdNisSvc.exe'
ORDER BY CreateTime DESC

-- Check Defender service configuration for tampering
SELECT 
    Name,
    DisplayName,
    State,
    StartMode,
    PathName,
    ProcessId
FROM wmi(query="SELECT * FROM Win32_Service WHERE Name LIKE '%WinDefend%' OR Name LIKE '%MsMpEng%'")
WHERE State != 'Running'

-- Scan for suspicious files in Defender directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Atime,
    Mode,
    Hash.MD5
FROM glob(globs="C:/ProgramData/Microsoft/Windows Defender/**/*")
WHERE Mtime > now() - 24h
   AND NOT FullPath =~ "\\.(log|dat|cache)$"

# RoguePlanet Vulnerability Remediation and Verification Script
# Run as Administrator

Write-Host "[+] Starting RoguePlanet Vulnerability Remediation Check" -ForegroundColor Cyan

# 1. Check current Defender engine version
$defenderInfo = Get-MpComputerStatus
$engineVersion = $defenderInfo.AntivirusSignatureVersion
Write-Host "[*] Current Defender Engine Version: $engineVersion" -ForegroundColor Yellow

# 2. Check for latest updates
Write-Host "[*] Initiating Defender update check..." -ForegroundColor Yellow
Update-MpSignature -UpdateSource MicrosoftUpdateServer

# 3. Verify Real-Time Protection is enabled
$realtimeProtection = (Get-MpPreference).DisableRealtimeMonitoring
if ($realtimeProtection -eq $false) {
    Write-Host "[+] Real-Time Protection: ENABLED" -ForegroundColor Green
} else {
    Write-Host "[!] Real-Time Protection: DISABLED - Enabling now..." -ForegroundColor Red
    Set-MpPreference -DisableRealtimeMonitoring $false
}

# 4. Verify Tamper Protection is enabled
$tamperProtection = (Get-MpComputerPreference).IsTamperProtected
if ($tamperProtection -eq $true) {
    Write-Host "[+] Tamper Protection: ENABLED" -ForegroundColor Green
} else {
    Write-Host "[!] Tamper Protection: DISABLED - Manual intervention required via Intune/Group Policy" -ForegroundColor Red
}

# 5. Check for suspicious exclusions that may indicate exploitation
$exclusions = Get-MpPreference
if ($exclusions.ExclusionPath -or $exclusions.ExclusionProcess) {
    Write-Host "[!] Review the following exclusions for legitimacy:" -ForegroundColor Yellow
    Write-Host "    Exclusion Paths: $($exclusions.ExclusionPath -join ', ')" -ForegroundColor Yellow
    Write-Host "    Exclusion Processes: $($exclusions.ExclusionProcess -join ', ')" -ForegroundColor Yellow
} else {
    Write-Host "[+] No suspicious exclusions detected" -ForegroundColor Green
}

# 6. Run a quick scan to ensure Defender is functional
Write-Host "[*] Running quick scan to verify Defender functionality..." -ForegroundColor Yellow
Start-MpScan -ScanType QuickScan

# 7. Check Windows Update for the specific RoguePlanet patch
Write-Host "[*] Checking for Windows Security Updates..." -ForegroundColor Yellow
$updates = Get-WindowsUpdate -MicrosoftUpdate
$roguePlanetPatched = $false
foreach ($update in $updates) {
    if ($update.Title -match "Defender" -and $update.InstallationDate -gt (Get-Date).AddDays(-7)) {
        Write-Host "[+] Recent Defender Update Found: $($update.Title)" -ForegroundColor Green
        $roguePlanetPatched = $true
    }
}

if ($roguePlanetPatched) {
    Write-Host "[+] System appears protected against RoguePlanet" -ForegroundColor Green
} else {
    Write-Host "[!] Unable to verify RoguePlanet patch. Check Windows Update manually." -ForegroundColor Red
}

Write-Host "[+] Remediation check complete." -ForegroundColor Cyan