ShieldBreak TOCTOU Race in Defender Remediation via MsMpEng/MpCmdRun

Arnold Chan@slaz

•updated Sep 7, 2026•3•0•8

Detects rapid, repeated invocation of Microsoft Defender remediation processes (mpcmdrun.exe, MsMpEng.exe) occurring in conjunction with suspicious file write or rename operations in System32. This pattern is characteristic of a Time-of-Check to Time-of-Use (TOCTOU) race condition, where an attacker attempts to exploit the timing gap between Defender's detection and remediation actions to replace a file with a malicious version.