ShieldCrash PoC: Unpatched Microsoft Defender Arbitrary File Read as SYSTEM — Detection and Hardening Guide

---
title: Suspicious Link or Junction Creation Targeting Microsoft Defender Directories
id: 3f8a2c14-7b61-4e5d-9c02-8a1d4f6b7e90
status: experimental
description: Detects use of link-creation utilities (mklink, fsutil, New-Item) to plant junctions, symlinks, or hardlinks pointing into or out of Microsoft Defender operating paths — a known staging pattern for AV privileged file-operation exploits such as ShieldCrash.
references:
  - https://securityaffairs.com/198726/security/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\cmd.exe'
      - '\fsutil.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_linkverb:
    CommandLine|contains:
      - 'mklink'
      - '/j '
      - '/d '
      - 'hardlink create'
      - 'New-Item'
      - 'SymbolicLink'
      - 'Junction'
  selection_path:
    CommandLine|contains:
      - 'ProgramData\Microsoft\Windows Defender'
      - 'Windows Defender\Platform'
      - 'Windows Defender\Quarantine'
      - 'MsMpEng'
  condition: selection_tool and selection_linkverb and selection_path
falsepositives:
  - Rare; legitimate administration of Defender directories via link tooling is highly unusual
level: high
---
title: Non-Microsoft Process Writing to Windows Defender Platform or Quarantine Paths
id: 6c1d9e27-4a53-4b8f-a710-2e9c5d8b3f41
status: experimental
description: Detects file creation or modification inside Microsoft Defender platform, quarantine, or scan staging directories by processes other than known Microsoft Defender/Update binaries — consistent with an attacker staging artifacts for a privileged file-read exploit.
references:
  - https://securityaffairs.com/198726/security/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows Defender\Quarantine'
      - '\ProgramData\Microsoft\Windows Defender\Scans'
      - '\ProgramData\Microsoft\Windows Defender\Platform'
  filter_legit:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'
      - '\MpSigStub.exe'
      - '\MsSense.exe'
      - '\SenseIR.exe'
      - '\MsMpEngCP.exe'
      - '\TrustedInstaller.exe'
      - '\TiWorker.exe'
      - '\svchost.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Third-party EDR management tools deploying alongside Defender
  - Software deployment systems servicing Defender platform updates (validate signer)
level: high
---
title: Unexpected Child Process Spawned by Microsoft Defender Engine
id: 9b4e7f38-1d62-4c3a-b845-5f0a2c9d6e17
status: experimental
description: Detects MsMpEng.exe spawning unexpected child processes. A compromised or exploited Defender engine executing attacker-controlled commands is a strong post-exploitation signal for AV-engine vulnerabilities.
references:
  - https://securityaffairs.com/198726/security/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\MsMpEng.exe'
  filter_known:
    Image|endswith:
      - '\MpCmdRun.exe'
      - '\NisSrv.exe'
      - '\MsMpEngCP.exe'
      - '\conhost.exe'
  condition: selection_parent and not filter_known
falsepositives:
  - Extremely rare; MsMpEng child processes outside its known set warrant investigation
level: critical

// Hunt: staging and exploitation artifacts for Defender privileged file-read abuse (ShieldCrash class)
// Looks for link-creation tooling aimed at Defender paths AND anomalous writes into Defender directories
let DefenderPaths = dynamic(["ProgramData\\Microsoft\\Windows Defender", "Windows Defender\\Quarantine", "Windows Defender\\Platform"]);
let LegitWriters = dynamic(["MsMpEng.exe", "MpCmdRun.exe", "MpSigStub.exe", "MsSense.exe", "SenseIR.exe", "TrustedInstaller.exe", "TiWorker.exe", "svchost.exe"]);
let LinkOps = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("mklink", "hardlink create", "New-Item", "SymbolicLink", "Junction")
| where ProcessCommandLine has_any (DefenderPaths)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId;
let DirWrites = DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (DefenderPaths)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where not(InitiatingProcessFileName has_any (LegitWriters))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType, ReportId;
union LinkOps, DirWrites
| sort by Timestamp desc

-- Hunt for staged artifacts in Microsoft Defender directories and link-creation activity
-- Deploy as a multi-client hunt across Windows endpoints
SELECT * FROM foreach(
  row={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
    WHERE CommandLine =~ '(?i)(mklink|hardlink create|New-Item|SymbolicLink|Junction)'
       AND CommandLine =~ '(?i)Windows Defender'
  },
  query={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM scope()
  })

// Separately: enumerate recent files planted in Defender quarantine/scans paths
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/ProgramData/Microsoft/Windows Defender/{Quarantine,Scans}/**')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

# ShieldCrash exposure verification and hardening audit
# Run as Administrator on each endpoint (or deploy via Intune/SCCM/GPO startup script)

# 1. Verify Defender engine/platform and signature currency — patch readiness baseline
$status = Get-MpComputerStatus
[PSCustomObject]@{
    AMEngineVersion         = $status.AMEngineVersion
    AMProductVersion        = $status.AMProductVersion
    AntivirusSignatureVer   = $status.AntivirusSignatureVersion
    SignatureLastUpdated    = $status.AntivirusSignatureLastUpdated
    RealTimeProtection      = $status.RealTimeProtectionEnabled
    TamperProtection        = $status.IsTamperProtected
} | Format-List

# 2. Confirm Tamper Protection is ON (prevents attacker tampering with Defender settings)
if (-not $status.IsTamperProtected) {
    Write-Warning "Tamper Protection is DISABLED on $env:COMPUTERNAME — enable via MDE/Intune/Defender portal"
}

# 3. Force immediate signature/platform update so the fix lands the moment Microsoft ships it
Update-MpSignature -ErrorAction SilentlyContinue

# 4. Audit for suspicious reparse points (junctions/symlinks) planted in Defender paths
$defenderPaths = @(
    "$env:ProgramData\Microsoft\Windows Defender"
)
foreach ($p in $defenderPaths) {
    Get-ChildItem -Path $p -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.Attributes -band [IO.FileAttributes]::ReparsePoint } |
        Select-Object FullName, LinkType, Target, LastWriteTime
}

# 5. Verify directory ACLs on Defender operating paths have not been loosened
$acl = Get-Acl "$env:ProgramData\Microsoft\Windows Defender"
$acl.Access | Where-Object {
    $_.FileSystemRights -match 'Write|Modify|FullControl' -and
    $_.IdentityReference -notmatch 'SYSTEM|Administrators|TrustedInstaller'
} | Select-Object IdentityReference, FileSystemRights, AccessControlType

# 6. Audit recent non-Microsoft handles: review process events touching Defender dirs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Windows Defender' } |
    Select-Object -First 50 TimeCreated, Message