ShieldBreak Unpatched Microsoft Defender Flaw Bypasses CVE-2026-50656 (RoguePlanet) Patch — Detection and Mitigation Guide

---
title: Symbolic Link or Junction Creation Targeting Microsoft Defender Paths
id: 8f2c4b17-3d9e-4a61-bf28-7c5e9a2d1043
status: experimental
description: Detects creation of symbolic links, junctions, or hardlinks pointing into Microsoft Defender directories, a hallmark of TOCTOU race-condition exploitation against the antimalware engine (RoguePlanet/ShieldBreak class).
references:
  - https://securityaffairs.com/197063/hacking/shieldbreak-new-windows-zero-day-bypasses-microsofts-rogueplanet-patch.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\fsutil.exe'
  selection_switch:
    CommandLine|contains:
      - 'mklink'
      - 'New-Item -ItemType SymbolicLink'
      - 'New-Item -ItemType Junction'
      - 'hardlink create'
      - '/j '
  selection_target:
    CommandLine|contains:
      - 'ProgramData\Microsoft\Windows Defender'
      - 'Program Files\Windows Defender'
      - 'MpCmdRun'
      - 'MsMpEng'
      - 'Quarantine'
      - 'Definition Updates'
  condition: selection_tool and selection_switch and selection_target
falsepositives:
  - Rare; legitimate administration almost never links into Defender-managed directories
level: high
---
title: Non-Microsoft Child Process Spawned by Microsoft Defender Engine
id: 2b7d9e41-6c3a-4f58-a190-4e8b2c6d3075
status: experimental
description: Detects MsMpEng.exe or MpCmdRun.exe spawning unexpected child processes. Defender's engine spawning shells, script interpreters, or unsigned binaries is a strong indicator of exploitation achieving code execution in the AV context.
references:
  - https://securityaffairs.com/197063/hacking/shieldbreak-new-windows-zero-day-bypasses-microsofts-rogueplanet-patch.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Defender remediation actions in rare enterprise configurations; verify against change records
level: critical
---
title: File Modification in Microsoft Defender Quarantine or Platform Directories by Non-Defender Process
id: 5a1e8c93-2f47-4b6d-9c31-8d4a7f1e5092
status: experimental
description: Detects processes other than Defender components creating or modifying files inside Defender's quarantine, platform, or signature directories, consistent with race-condition payload staging for SYSTEM-level execution.
references:
  - https://securityaffairs.com/197063/hacking/shieldbreak-new-windows-zero-day-bypasses-microsofts-rogueplanet-patch.html
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Windows Defender\Quarantine\'
      - '\Windows Defender\Platform\'
      - '\Definition Updates\'
  filter_legit:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'
      - '\MpSigStub.exe'
      - '\NisSrv.exe'
      - '\MsSense.exe'
      - '\TiWorker.exe'
      - '\svchost.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Manual AV administration; third-party EDR management tooling
level: high

// Hunt: Suspicious child processes of Microsoft Defender engine (ShieldBreak/RoguePlanet class)
// Tables: DeviceProcessEvents (Defender for Endpoint / Sentinel)
let DefenderParents = dynamic(["MsMpEng.exe", "MpCmdRun.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "net.exe", "whoami.exe", "nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (DefenderParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt: Link/junction tooling invoked against Defender paths
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("mklink", "SymbolicLink", "Junction", "hardlink")
| where ProcessCommandLine has_any ("Windows Defender", "MsMpEng", "Quarantine", "Definition Updates", "MpCmdRun")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

// Hunt: Non-Defender file writes into Defender-managed directories
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\Windows Defender\\Quarantine\\", "\\Windows Defender\\Platform\\", "\\Definition Updates\\")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MpCmdRun.exe", "MpSigStub.exe", "NisSrv.exe", "MsSense.exe", "TiWorker.exe", "svchost.exe", "System")
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, FolderPath, FileName, SHA256
| order by TimeGenerated desc

-- Hunt for link-creation tooling and suspicious process lineage around Microsoft Defender
-- Artifact targets: process execution, Defender-path file artifacts, junction abuse
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mklink|symboliclink|junction|hardlink)'
  AND CommandLine =~ '(?i)(Windows Defender|MsMpEng|Quarantine|Definition Updates)'

-- Correlate: enumerate files staged in Defender quarantine/platform paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/ProgramData/Microsoft/Windows Defender/Quarantine/**',
  'C:/ProgramData/Microsoft/Windows Defender/Platform/**'
])
WHERE NOT FullPath =~ '(?i)\\.(mdb|vdm|dll|cat|exe)$'
ORDER BY Mtime DESC

# ShieldBreak / RoguePlanet posture verification and hardening script
# Run as Administrator on each endpoint or deploy via Intune/SCCM/GPO startup script

Write-Host "=== [1/5] Verify CVE-2026-50656 (RoguePlanet) patch status ===" -ForegroundColor Cyan
# Confirm Defender platform/engine are on the latest available build
$mpStatus = Get-MpComputerStatus
[PSCustomObject]@{
    AMEngineVersion       = $mpStatus.AMEngineVersion
    AMProductVersion      = $mpStatus.AMProductVersion
    SignatureVersion      = $mpStatus.AntivirusSignatureVersion
    SignatureLastUpdated  = $mpStatus.AntivirusSignatureLastUpdated
    RealTimeProtection    = $mpStatus.RealTimeProtectionEnabled
    TamperProtection      = $mpStatus.IsTamperProtected
} | Format-List

Write-Host "=== [2/5] Enforce Tamper Protection and real-time protection ===" -ForegroundColor Cyan
# Tamper Protection must be enforced from the Defender portal / Intune; verify locally:
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false

Write-Host "=== [3/5] Audit NTFS permissions on Defender-managed directories ===" -ForegroundColor Cyan
$paths = @(
    "$env:ProgramData\Microsoft\Windows Defender",
    "$env:ProgramFiles\Windows Defender"
)
foreach ($p in $paths) {
    if (Test-Path $p) {
        $acl = Get-Acl $p
        $acl.Access | Where-Object {
            $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
            $_.FileSystemRights -match 'Write|Modify|FullControl'
        } | ForEach-Object {
            Write-Warning "Weak ACL on $p : $($_.IdentityReference) -> $($_.FileSystemRights)"
        }
    }
}

Write-Host "=== [4/5] Detect pre-existing junctions/symlinks into Defender paths ===" -ForegroundColor Cyan
Get-Item "$env:ProgramData\Microsoft\Windows Defender\*" -Force -ErrorAction SilentlyContinue |
    Where-Object { $_.LinkType -match 'Junction|SymbolicLink' } |
    ForEach-Object { Write-Warning "Suspicious link: $($_.FullName) -> $($_.Target)" }

Write-Host "=== [5/5] Confirm attack surface reduction and cloud protection ===" -ForegroundColor Cyan
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableRealtimeMonitoring | Format-List
Write-Host "=== Verification complete. Escalate any warnings to the IR team. ===" -ForegroundColor Green