ShieldBreak PoC Claims Microsoft Defender Patch Bypass for CVE-2026-50656 (RoguePlanet) — Detection, Hunting, and Mitigation Guide

---
title: Microsoft Defender Process Spawning Suspicious Child Process
tid: 3f9a1c72-8b4e-4d5a-9c21-7e6f2a1b8d03
status: experimental
description: Detects Microsoft Defender platform processes (MsMpEng, MsSense, MpCmdRun, SenseIR) spawning command interpreters or script hosts, consistent with privilege escalation payload execution following a Defender EoP such as ShieldBreak/CVE-2026-50656.
references:
  - https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\MsMpEng.exe'
      - '\MsSense.exe'
      - '\MpCmdRun.exe'
      - '\SenseIR.exe'
      - '\NisSrv.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — legitimate Defender components do not normally spawn shells or script hosts
level: critical
---
title: Non-System Process Tampering With Microsoft Defender Configuration
tid: 8c2d4e61-5a93-4f7b-b1e8-2d9c6f4a7e15
status: experimental
description: Detects attempts to disable or weaken Microsoft Defender via PowerShell Set-MpPreference, registry modification, or service control — a common precursor or follow-on to Defender-focused privilege escalation exploits such as ShieldBreak.
references:
  - https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableIOAVProtection'
      - 'Add-MpPreference'
      - 'ExclusionPath'
  selection_sc:
    CommandLine|contains:
      - 'stop WinDefend'
      - 'stop Sense'
      - 'config WinDefend start= disabled'
  selection_reg:
    CommandLine|contains:
      - 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender'
      - 'DisableAntiSpyware'
      - 'DisableAntiVirus'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative exclusions via approved change management — filter by approved admin accounts and management tooling (SCCM/Intune) context
level: high
---
title: Symbolic Link or Junction Creation In Defender-Accessible Directories
tid: 5e7b9d24-3c61-4a8f-a952-1f8e3c5b9d27
status: experimental
description: Detects creation of directory junctions or symbolic links via mklink or New-Item in paths commonly abused to redirect privileged file operations during Defender elevation-of-privilege exploitation such as ShieldBreak.
references:
  - https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'mklink /j'
      - 'mklink /d'
      - 'mklink /h'
      - '-ItemType SymbolicLink'
      - '-ItemType Junction'
  filter_admin:
    User|contains: 'SYSTEM'
  condition: selection and not filter_admin
falsepositives:
  - Developers and package managers creating symlinks in build directories — investigate path targets; junctions pointing into Program Files, Windows, or ProgramData\Microsoft\Windows Defender are highly suspicious
level: medium

// Hunt 1: Defender platform processes spawning shells or script hosts (SYSTEM escalation materialization)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("MsMpEng.exe", "MsSense.exe", "MpCmdRun.exe", "SenseIR.exe", "NisSrv.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessIntegrityLevel
| order by TimeGenerated desc

// Hunt 2: Defender tampering commands executed by non-SYSTEM interactive users
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("Set-MpPreference", "DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "stop WinDefend", "DisableAntiSpyware", "ExclusionPath")
| where AccountName !~ "system"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt 3: File writes by Defender processes into user-writable or service binary paths (arbitrary write primitive)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("MsMpEng.exe", "MsSense.exe", "MpCmdRun.exe")
| where ActionType == "FileCreated" or ActionType == "FileModified"
| where FolderPath has_any ("\\Users\\", "\\Temp\\", "\\AppData\\") or FolderPath has ("\\ProgramData\\Microsoft\\Windows Defender")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
| order by TimeGenerated desc

-- ShieldBreak / Defender EoP hunt: suspicious Defender process lineage and tamper commands
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
    -- Defender process spawned by an unusual parent (exploit stager)
    (Name =~ '(?i)(MsMpEng|MsSense|MpCmdRun|SenseIR)\.exe'
        AND CommandLine =~ '(?i)(cmd|powershell|pwsh|rundll32|wscript|cscript|mshta)')
  )
  OR (
    -- Pre/post-exploitation Defender tampering by interactive users
    CommandLine =~ '(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring|stop WinDefend|DisableAntiSpyware)'
    AND NOT Username =~ '(?i)SYSTEM'
  )

# ShieldBreak / CVE-2026-50656 (RoguePlanet) — Defender posture verification and hardening audit
# Run elevated on each endpoint, or deploy via Intune/SCCM/GPO startup script with logging to a central share

$Report = [ordered]@{}
$Report.Hostname = $env:COMPUTERNAME
$Report.Timestamp = (Get-Date).ToString("o")

# 1. Verify Defender engine and platform versions — confirm the RoguePlanet fix level is applied
try {
    $MpStatus = Get-MpComputerStatus
    $Report.AMEngineVersion       = $MpStatus.AMEngineVersion
    $Report.AMProductVersion      = $MpStatus.AMProductVersion
    $Report.AMServiceVersion      = $MpStatus.AMServiceVersion
    $Report.SignatureVersion      = $MpStatus.AntivirusSignatureVersion
    $Report.RealTimeProtection    = $MpStatus.RealTimeProtectionEnabled
    $Report.BehaviorMonitoring    = $MpStatus.BehaviorMonitorEnabled
    $Report.IOAVProtection        = $MpStatus.IoavProtectionEnabled
    $Report.TamperProtection      = $MpStatus.IsTamperProtected
    $Report.DefenderRunning       = $MpStatus.AMServiceEnabled
} catch {
    $Report.MpStatusError = $_.Exception.Message
}

# 2. Flag endpoints where Tamper Protection is OFF — highest risk for ShieldBreak follow-on activity
if ($Report.TamperProtection -eq $false) {
    Write-Warning "[$env:COMPUTERNAME] Tamper Protection DISABLED — enable via Intune/Defender portal immediately"
}
if ($Report.RealTimeProtection -eq $false) {
    Write-Warning "[$env:COMPUTERNAME] Real-time protection DISABLED — investigate for tampering"
}

# 3. Audit for suspicious Defender exclusions added post-compromise (common EoP follow-on)
$Prefs = Get-MpPreference
$Report.ExclusionPaths = ($Prefs.ExclusionPath -join ';')
if ($Prefs.ExclusionPath) {
    Write-Warning "[$env:COMPUTERNAME] Exclusion paths present — validate each against change control: $($Prefs.ExclusionPath -join '; ')"
}

# 4. Confirm August 2026+ cumulative update presence ( RoguePlanet fix baseline ); list recent hotfixes
$Report.RecentHotfixes = (Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn | Out-String).Trim()

# 5. Check for unexpected services/tasks referencing user-writable paths (persistence after SYSTEM escalation)
$SuspiciousServices = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'Users\\|AppData|Temp' -and $_.StartMode -eq 'Auto'
} | Select-Object Name, PathName, StartName
$Report.SuspiciousServices = ($SuspiciousServices | Out-String).Trim()

# 6. Output — ship to SIEM/central log share
$Report.GetEnumerator() | ForEach-Object { "{0}: {1}" -f $_.Key, $_.Value } | Out-File -Append "C:\ProgramData\ShieldBreak-Audit-$env:COMPUTERNAME.txt"

# Optional: forward to central share
# Copy-Item "C:\ProgramData\ShieldBreak-Audit-$env:COMPUTERNAME.txt" "\\<logserver>\audits\"