ShieldBreak CLFS log creation/lock for TOCTOU race sync

Duo Tech@duotech

•updated Aug 12, 2026•3•0•13

Detects creation and locking of a CLFS log file matching the ShieldBreak-specific naming/path pattern, used to synchronize the exploit's TOCTOU race window against Microsoft Defender. Excludes legitimate CLFS consumers (MSMQ, TxR/TxF) and Windows servicing operations.