ShieldCrash Unpatched Microsoft Defender Privilege Escalation: Detection, Hardening, and Response Guide

---
title: Defender Tamper Commandline After Possible ShieldCrash Exploitation
id: 8f6c7a11-6f44-4c8d-9d50-shieldcrash01
status: experimental
description: Detects command-line attempts to weaken Microsoft Defender through exclusions, real-time monitoring changes, tamper-related settings, or signature update suppression. This is a post-exploitation analytic for an unpatched Defender privilege escalation and may also catch legitimate administration, so scope by approved change windows and admin accounts.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\MpCmdRun.exe'
      - '\sc.exe'
      - '\reg.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'Add-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableIOAVProtection'
      - 'ExclusionPath'
      - 'ExclusionProcess'
      - 'ExclusionExtension'
      - 'MpPreference'
      - 'WinDefend'
      - 'Sense'
      - 'TamperProtection'
  condition: selection_tool and selection_cmd
falsepositives:
  - Approved endpoint administration, GPO or Intune rollout, incident response tooling
level: high
---
title: Defender Or MDE Process Spawning Command Shell Or Script Interpreter
id: 3bd7ce54-6f4f-4ef3-a811-shieldcrash02
status: experimental
description: Detects suspicious child processes under Microsoft Defender or MDE-related parents. Exploitation or post-exploitation may appear as cmd, PowerShell, rundll32, regsvr32, mshta, wscript, or service control launched from MsMpEng, MsSense, SenseIR, or MpCmdRun context.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\MsMpEng.exe'
      - '\MsSense.exe'
      - '\SenseIR.exe'
      - '\MpCmdRun.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\sc.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare Defender remediation or response actions, EDR live response, vendor support sessions
level: critical

// Hunt for Defender tampering and suspicious privilege transitions after Sept 2026 patching
let start = datetime(2026-09-01);
union withsource=src (DeviceProcessEvents, SecurityEvent)
| where TimeGenerated >= start
| extend Process = coalesce(FileName, tostring(NewProcessName)), Command = coalesce(ProcessCommandLine, tostring(CommandLine)), Parent = coalesce(InitiatingProcessFileName, tostring(ParentProcessName)), Account = coalesce(InitiatingProcessAccountName, AccountName)
| where Parent in~ ('MsMpEng.exe','MsSense.exe','SenseIR.exe','MpCmdRun.exe')
   or Command has_any ('Set-MpPreference','Add-MpPreference','DisableRealtimeMonitoring','ExclusionPath','ExclusionProcess','TamperProtection','WinDefend','Sense')
   or (Account =~ 'SYSTEM' and Process in~ ('cmd.exe','powershell.exe','pwsh.exe','rundll32.exe','regsvr32.exe','sc.exe','net.exe','whoami.exe'))
| project TimeGenerated, src, DeviceName, Account, Parent, Process, Command, ProcessId, InitiatingProcessId, ReportId
| order by TimeGenerated desc

-- Hunt for Defender tamper commandlines and suspicious SYSTEM-spawned admin tools
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'Set-MpPreference|Add-MpPreference|DisableRealtimeMonitoring|ExclusionPath|ExclusionProcess|TamperProtection|WinDefend|Sense'
   OR (Username =~ 'SYSTEM' AND Name =~ 'cmd.exe|powershell.exe|pwsh.exe|rundll32.exe|regsvr32.exe|sc.exe|net.exe|whoami.exe')

# ShieldCrash defensive verification and hardening snapshot. Run elevated. Review before changing exclusions.
$ErrorActionPreference = 'SilentlyContinue'
$out = "$env:ProgramData\ShieldCrash_Defender_Posture_$(Get-Date -Format yyyyMMdd_HHmmss).json"

$os = Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,LastBootUpTime
$hotfixes = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 25 HotFixID,Description,InstalledOn
$status = Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,OnAccessProtectionEnabled,AntispywareEnabled,TamperProtectionSource,TPState,PlatformVersion,EngineVersion,AntivirusSignatureVersion,QuickScanEndTime,FullScanEndTime
$pref = Get-MpPreference | Select-Object DisableRealtimeMonitoring,DisableBehaviorMonitoring,DisableIOAVProtection,DisableScriptScanning,ExclusionPath,ExclusionProcess,ExclusionExtension,AttackSurfaceReductionRules_Ids,AttackSurfaceReductionRules_Actions
$svc = Get-CimInstance Win32_Service | Where-Object {$_.Name -in 'WinDefend','Sense','WdNisSvc','MDCoreSvc'} | Select-Object Name,DisplayName,State,StartMode,PathName,StartName
$admins = Get-LocalGroupMember -Group 'Administrators' | Select-Object Name,PrincipalSource,ObjectClass
$suspicious = Get-CimInstance Win32_Process | Where-Object {$_.CommandLine -match 'Set-MpPreference|Add-MpPreference|DisableRealtimeMonitoring|ExclusionPath|ExclusionProcess|TamperProtection' -or ($_.Name -in 'cmd.exe','powershell.exe','pwsh.exe','rundll32.exe','regsvr32.exe','sc.exe' -and $_.ExecutablePath -match 'MsMpEng|MsSense|SenseIR|MpCmdRun')} | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine,CreationDate

[pscustomobject]@{
  Computer = $env:COMPUTERNAME
  CollectedUtc = (Get-Date).ToUniversalTime()
  OS = $os
  RecentHotfixes = $hotfixes
  DefenderStatus = $status
  DefenderPreference = $pref
  SecurityServices = $svc
  LocalAdministrators = $admins
  SuspiciousDefenderProcessActivity = $suspicious
} | ConvertTo-Json -Depth 6 | Set-Content -Path $out -Encoding UTF8

# Safe assertions: re-enable key protections if your management plane allows local enforcement. Do not remove exclusions without change approval.
if ($status.RealTimeProtectionEnabled -eq $false) { Set-MpPreference -DisableRealtimeMonitoring $false }
if ($status.BehaviorMonitorEnabled -eq $false) { Set-MpPreference -DisableBehaviorMonitoring $false }
if ($status.IoavProtectionEnabled -eq $false) { Set-MpPreference -DisableIOAVProtection $false }

Write-Output "Defender posture evidence written to $out"
Write-Output 'Confirm Tamper Protection in the Defender portal or Intune, validate ASR rules, and alert on any WinDefend or Sense service stop, disable, delete, or path change.'