ShieldBreak Windows Zero-Day: Defending Against the Nightmare Eclipse Unpatched Privilege Escalation Exploit

---
title: SYSTEM Shell Spawned by Non-System Parent Process
tid: 3f8b2c41-7a1e-4d59-b9c6-2e4a5f7d8c01
status: experimental
description: Detects command shells or script interpreters running as NT AUTHORITY\SYSTEM whose parent process runs in a non-SYSTEM user context — the characteristic end state of local privilege escalation exploits such as ShieldBreak. Requires command-line process creation auditing (Sysmon ID 1 or 4688 with command line).
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_system:
    User:
      - 'NT AUTHORITY\SYSTEM'
      - 'SYSTEM'
  filter_parents:
    ParentImage|endswith:
      - '\wininit.exe'
      - '\services.exe'
      - '\svchost.exe'
      - '\smss.exe'
      - '\winlogon.exe'
      - '\lsass.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\MsMpEng.exe'
  condition: all of selection_* and not filter_parents
falsepositives:
  - Systems management tooling (SCCM, Intune, Tanium, PDQ) spawning SYSTEM shells from user-initiated deployments
  - PaaS/agent software executing remediation scripts as SYSTEM
level: high
---
title: Suspicious Binary Execution From User-Writable Path Followed by SYSTEM Activity
id: 9c1e7a52-4b3d-4e68-a1f5-8d2c6b9e3a47
status: experimental
description: Detects execution of binaries from user-writable staging directories (Temp, AppData, Public, ProgramData) — typical drop location for privilege escalation exploit payloads such as ShieldBreak — particularly renamed or unsigned executables.
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
  selection_suspicious:
    CommandLine|contains:
      - 'whoami'
      - 'system'
      - 'nc '
      - 'ncat '
      - ' -e cmd'
      - ' -e powershell'
  filter_known:
    Image|contains:
      - '\AppData\Local\Microsoft\'
      - '\AppData\Local\Google\'
      - '\AppData\Local\Programs\'
      - 'AppData\Roaming\Zoom\'
      - 'AppData\Local\Slack\'
  condition: selection_path and selection_suspicious and not filter_known
falsepositives:
  - Developer tooling and self-updating applications executing from AppData
level: medium
---
title: LSASS Access by Non-Standard Process After Privilege Escalation
id: 5d2a9f13-8c4b-4a72-b6e1-3f7d5c8a2e69
status: experimental
description: Detects processes opening a handle to lsass.exe with access rights consistent with credential dumping. A common immediate follow-on action after an attacker obtains SYSTEM via a local privilege escalation such as ShieldBreak.
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/
  - https://attack.mitre.org/techniques/T1003.001/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_legit:
    SourceImage|endswith:
      - '\svchost.exe'
      - '\MsMpEng.exe'
      - '\wininit.exe'
      - '\lsm.exe'
      - '\csrss.exe'
  condition: selection and not filter_legit
falsepositives:
  - EDR and backup agents legitimately inspecting LSASS
  - Credential Guard related system components
level: high

// Hunt: SYSTEM-context shells spawned outside of trusted service parents
// Covers the observable end-state of the ShieldBreak local privilege escalation
let Lookback = 7d;
let TrustedSystemParents = dynamic([
    "wininit.exe", "services.exe", "svchost.exe", "smss.exe",
    "winlogon.exe", "lsass.exe", "msiexec.exe", "TiWorker.exe",
    "MsMpEng.exe", "SenseIR.exe", "MsSense.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where AccountName =~ "SYSTEM" or InitiatingProcessAccountName =~ "system"
| extend ParentName = tostring(split(InitiatingProcessFileName, "")[0])
| where not(InitiatingProcessFileName in~ (TrustedSystemParents))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, InitiatingProcessIntegrityLevel, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt: 4688 process creation where a High/System integrity shell is created
// by a process running in a standard user session (Sysmon-free environments)
let Lookback = 7d;
SecurityEvent
| where TimeGenerated > ago(Lookback)
| where EventID == 4688
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "pwsh.exe")
| where NewProcessName !has "System32" or CommandLine has_any ("whoami", "-enc", "FromBase64")
| where ParentProcessName !has_any ("services.exe", "wininit.exe", "svchost.exe", "msiexec.exe", "ccmexec.exe", "tanium")
| extend IntegrityJump = iff(MandatoryLabel has "S-1-16-16384" or SubjectUserName =~ "SYSTEM", "SYSTEM-context", "User-context")
| project TimeGenerated, Computer, SubjectUserName, NewProcessName, CommandLine,
          ParentProcessName, IntegrityJump
| order by TimeGenerated desc;

-- Hunt: ShieldBreak-style privilege escalation artifacts
-- Part 1: SYSTEM shells whose parent is not a trusted service binary
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)cmd\.exe$|powershell\.exe$|pwsh\.exe$')
  AND Username =~ '(?i)SYSTEM'
  AND Ppid NOT IN (
        SELECT Pid FROM pslist()
        WHERE Name =~ '(?i)services\.exe|wininit\.exe|svchost\.exe|lsass\.exe|msiexec\.exe'
      )

-- Part 2: Executables written to common exploit staging paths in the last 7 days
SELECT FullPath,
       Size,
       Mtime,
       Ctime,
       hash(path=FullPath) AS Hash
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.exe',
  'C:/Users/Public/*.exe',
  'C:/Windows/Temp/*.exe',
  'C:/ProgramData/*.exe'
])
WHERE Mtime > now() - 7 * 24 * 3600
ORDER BY Mtime DESC

# ShieldBreak interim hardening - run as Administrator
# 1) Verify/enable LSA Protection (blunts credential theft after SYSTEM escalation)
$lsa = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue
if (-not $lsa -or $lsa.RunAsPPL -ne 1) {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -Value 1 -Type DWord
    Write-Host '[+] LSA Protection (RunAsPPL) enabled - reboot required'
} else { Write-Host '[=] LSA Protection already enabled' }

# 2) Verify Credential Guard status
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($cg -and $cg.SecurityServicesRunning -contains 1) {
    Write-Host '[=] Credential Guard is running'
} else { Write-Host '[!] Credential Guard NOT running - enable via GPO/Intune (UEFI lock recommended)' }

# 3) Enable ASR rule: block credential stealing from lsass + Office child processes
$asrRules = @(
    @{ Id = '9e6c4e1f-7d60-472f-baea-a39ef669d96b'; Name = 'Block credential stealing from lsass.exe' },
    @{ Id = 'd4f940ab-401b-4efc-aadc-ad5f3c50688a'; Name = 'Block Office from creating child processes' },
    @{ Id = '56a863a9-875e-4185-98a7-b882c64b5ce5'; Name = 'Block abuse of exploited vulnerable signed drivers' }
)
foreach ($rule in $asrRules) {
    Set-MpPreference -AttackSurfaceReductionRules_Ids $rule.Id -AttackSurfaceReductionRules_Actions Enabled
    Write-Host "[+] ASR enabled: $($rule.Name)"
}

# 4) Audit: who can log on locally (review output - trim to least privilege)
Write-Host '[*] Local logon rights (secedit export):'
secedit /export /cfg "$env:TEMP\secpol_export.inf" | Out-Null
Select-String -Path "$env:TEMP\secpol_export.inf" -Pattern 'SeInteractiveLogonRight|SeDenyInteractiveLogonRight'
Remove-Item "$env:TEMP\secpol_export.inf" -Force

# 5) Report recent SYSTEM shells with unusual parents (triage, last 24h, requires 4688 auditing)
Write-Host '[*] Recent suspicious SYSTEM shell activity (24h):'
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688; StartTime = (Get-Date).AddHours(-24) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'New Process Name.*(cmd\.exe|powershell\.exe|pwsh\.exe)' -and $_.Message -notmatch 'Creator Process Name.*(services\.exe|wininit\.exe|svchost\.exe|msiexec\.exe)' } |
    Select-Object -First 25 TimeCreated, Message | Format-List