ShieldCrash WD_SCAN Object Link Redirect to Loopback UNC Share

Arnold Chan@slaz

•updated Sep 9, 2026•1•0•1

Detects the creation of Object Manager symbolic links that redirect the Windows Defender 'WD_SCAN' object to a loopback UNC share path. This behavior is indicative of a symlink exploitation technique (ShieldCrash/CVE-2026-69414) used to manipulate Windows Defender or associated scan operations by redirecting them to an adversary-controlled or loopback-hosted target.