Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
9
3
Contributors
12
Categories
6
5
4
2
Platforms
12
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
3
2
2
2
1
CVEs
12
Detects a SYSTEM-privileged cmd.exe/powershell.exe process spawned in close temporal/process proximity to Microsoft Defender's scanning process (MsMpEng.exe), consistent with successful exploitation of the ShieldBreak zero-day (CVE-2026-50656) TOCTOU bypass. Excludes known legitimate SYSTEM shell spawns from scheduled tasks, SCCM/Intune, and PsExec-style tooling.
Detects a Windows Error Reporting (WER) crash report for MsMpEng.exe whose fault signature matches the ShieldBreak exploit crash pattern, indicating the Defender process crashed as a byproduct of the TOCTOU exploitation attempt. Excludes routine crashes tied to signature/platform updates.
Detects the compiled ShieldBreak C++ proof-of-concept exploit binary via embedded source/resource path strings and PE header, indicating local possession or execution of the CVE-2026-50656 Defender bypass PoC.
Detects loading of Warden.dll — the Defender-bypass component of the ShieldBreak exploit — when unsigned or not signed by Microsoft, excluding legitimate signed Defender platform update binaries.
Detects registration of an unrecognized cloud sync provider combined with placeholder file creation within a short window, consistent with ShieldBreak's TOCTOU race staging technique. Excludes signed installs/re-registrations of known legitimate cloud sync clients (OneDrive, Dropbox, Google Drive, Box).
Detects creation and locking of a CLFS log file matching the ShieldBreak-specific naming/path pattern, used to synchronize the exploit's TOCTOU race window against Microsoft Defender. Excludes legitimate CLFS consumers (MSMQ, TxR/TxF) and Windows servicing operations.
Detects ntdll.dll being copied into an alternate data stream at a ShieldBreak-specific staging path, used to prepare the overwrite of a protected system DLL. Excludes legitimate backup, imaging, and EDR/forensic tooling that streams or duplicates system DLLs.
Detects presence of the EICAR AV test file only when co-occurring with ShieldBreak exploit artifacts (PoC binary, build files, or Warden.dll) in the same directory or process context, indicating exploit development/testing activity rather than routine AV testing.
Detects the ShieldBreak Defender-scan TOCTOU exploit locking an alternate data stream on the protected system DLL phoneinfo.dll immediately prior to an arbitrary write — the core privilege-escalation primitive of CVE-2026-50656. Excludes legitimate Windows Update/servicing operations.
Detects execution of whoami.exe as NT AUTHORITY\SYSTEM within a short window of, and parented by, a suspicious SYSTEM-privileged shell spawn — a common post-exploitation confirmation step following successful ShieldBreak exploitation. Standalone whoami execution is excluded by design.
Correlates the ShieldBreak PoC's 'Exploit succeeded' console output with a SYSTEM-privileged cmd.exe spawn in the same process session within a short window, confirming successful end-to-end exploitation of CVE-2026-50656.
Detects creation of restricted object manager namespace objects (WD_TARGET_/WD_SHADOW_/WD_SCAN) used to hijack Microsoft Defender's on-access scan target as part of the ShieldBreak exploit, excluding objects created by signed Microsoft/Defender processes.