ShieldCrash malicious Cloud Filter provider registration

Arnold Chan@slaz

•updated 27 days ago•4•0•4

Detects the suspicious registration of a Cloud Filter provider callback using staging paths and naming conventions associated with the ShieldCrash (CVE-2026-69414) exploit. The rule monitors DeviceEvents for cloud provider activity that originates from unsigned or untrusted binaries, excluding known-legitimate cloud synchronization clients.