ShieldCrash Object Manager WD_TARGET/WD_SHADOW/WD_SCAN Creation

Arnold Chan@slaz

•updated Sep 9, 2026•2•0•1

Detects the creation of specific Object Manager namespace directories and objects used by the ShieldCrash proof-of-concept (CVE-2026-69414) to hijack the Microsoft Defender scan process.