ShieldBreak race-condition completion via phoneinfo.dll:stream lock

Adarsh Pandey@Pandeyadarsh

•updated Aug 25, 2026•4•0•9

Detects the modification or creation of an NTFS alternate data stream (ADS) on the system file phoneinfo.dll in System32, followed by the execution of a command process within two minutes. This pattern is often associated with file-based living-off-the-land techniques where attackers hide payloads or scripts within existing file metadata to evade detection.