1. Description of the exploitation mechanism for a SOC analyst
ShieldBreak is a local privilege escalation chain to NT AUTHORITY\SYSTEM, claimed by the author to be a bypass of the fix for CVE-2026-50656 (RoguePlanet) in Microsoft Defender. For exploitation, the attacker already needs the ability to execute code on the host, but administrative privileges are not required.
2. How the attack works
2.1. Preparation of a controlled file
The exploit creates a working directory and registers it as a Cloud Files sync root. Inside it, a placeholder file named BERLIN is created. Its contents are returned on request through a callback, allowing the attacker to change the data between read operations.
2.2. Creation of dual path resolution
Through Windows Object Manager, the WD_SHADOW_* and WD_TARGET_* directories and the WD_SCAN symbolic links are created. While the first link exists, the path passed to Defender leads to the regular BERLIN file. After its deletion, the same string is resolved through CLFS.
2.3. Obtaining the Defender verdict
The exploit itself initiates resource scanning through MpClient.dll. On the first read, the Cloud Files callback returns a ZIP archive containing EICAR. Defender detects the test threat and starts the cleanup procedure on behalf of SYSTEM. The state of real-time protection is not essential for this sequence, since scanning is invoked directly.
2.4. Substitution of the destination during cleanup
After the threat is detected, the PoC deletes the first WD_SCAN link, waits for the creation of the CLFS service file, and locks it through LockFileEx. A new chain of links is then created, leading through the local administrative SMB share to:
\127.0.0.1\C$\Windows\System32\phoneinfo.dll
2.5. Replacement of the contents
Placeholder hydration is restarted. On subsequent reads, the callback returns Warden.dll instead of the EICAR archive. As a result, the Defender operation running with SYSTEM privileges writes the attacker's DLL to C:\Windows\System32.
2.6. Retaining the file
The PoC waits for phoneinfo.dll:stream to appear and maps the valid PE file contained there as an executable image. This keeps the file object open and prevents the cleanup procedure from deleting the created file.
2.7. Executing the DLL as SYSTEM
The exploit places a prepared Report.wer into the Windows Error Reporting queue and starts the existing task:
\Microsoft\Windows\Windows Error Reporting\QueueReporting
Task Scheduler starts wermgr.exe with system privileges. It loads phoneinfo.dll, after which the Warden.dll code is executed as SYSTEM.
2.8. Obtaining a system process
The payload connects to the SHIELDBREAK named pipe, obtains the system process token, transfers it to the interactive session, and starts a process with SYSTEM privileges. The connection to the pipe simultaneously serves as the PoC confirmation of successful exploitation.
More details - ShieldBreak – description of the exploitation mechanism for a SOC analyst