CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)

Key facts for RoguePlanet Malware Protection Engine LPE

Detection coverage for RoguePlanet Malware Protection Engine LPE

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0835 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RoguePlanet — Interactive Shell Spawned by Defender Engine (MsMpEng.exe) — Exploitation

Detects the primary RoguePlanet (CVE-2026-50656) SYSTEM-execution signal: an interactive shell or console host whose parent process is MsMpEng.exe (the Microsoft Malware Protection Engine running as NT AUTHORITY\SYSTEM). The TOCTOU/junction chain coerces Defender into executing the attacker's redirected wermgr.exe, which then spawns an interactive cmd.exe/powershell.exe/conhost.exe at SYSTEM integrity. This parent-child lineage should never occur in a healthy environment and is the highest-fidelity indicator of successful exploitation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1574, T1559
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\MsMpEng.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\conhost.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe")
| eval is_system=if(match(IntegrityLevel,"(?i)system") OR User="NT AUTHORITY\\SYSTEM",1,0)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(Image) as child_proc values(CommandLine) as cmdline values(IntegrityLevel) as integrity by Computer, ParentImage, User
| where count > 0
| convert ctime(firstSeen) ctime(lastSeen)
| sort - lastSeen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","conhost.exe","cscript.exe","wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessIntegrityLevel
| order by Timestamp desc

Sigma

title: RoguePlanet Interactive Shell Spawned by Defender Engine (MsMpEng.exe)
id: 7c1d4e90-0835-4a01-9b10-rp00000spl01
status: experimental
description: Detects an interactive shell or console host whose parent is MsMpEng.exe at SYSTEM integrity, the primary RoguePlanet (CVE-2026-50656) SYSTEM-execution signal. Should never occur in a healthy environment.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656
    - https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/17
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1574
    - attack.t1559
    - cve.2026.50656
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\MsMpEng.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\conhost.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    condition: selection
fields:
    - Image
    - ParentImage
    - IntegrityLevel
    - CommandLine
falsepositives:
    - Extremely rare Defender troubleshooting or support tooling that shells out; validate integrity level and command line.
level: critical

Known false positives:

• Rare Defender support or troubleshooting tooling that legitimately spawns a console; verify SYSTEM integrity and command line before escalating.

Tuning notes: This lineage is effectively never legitimate — alert at critical with no threshold. Optionally enrich with IntegrityLevel=System to remove any non-elevated edge cases, and pivot to the spawned child's own children to capture the follow-on interactive session.

• 🔒 RoguePlanet — wermgr.exe Execution Outside System32 via Junction Redirection — Exploitation · unlock with TL Creds
• 🔒 RoguePlanet — WER QueueReporting Scheduled Task Triggered by Unprivileged User — Post-Exploitation · unlock with TL Creds
• 🔒 RoguePlanet — Unexpected ISO/VHD Mount From Temp by Non-System User — Lateral Staging · unlock with TL Creds
• 🔒 RoguePlanet — NTFS Junction / Reparse-Point Creation in User-Writable Paths — Exploitation Primitive · unlock with TL Creds
• 🔒 RoguePlanet — NtQueryDirectoryObject VSS Enumeration + Poseidon I/O Saturation — Race Priming · unlock with TL Creds
• 🔒 RoguePlanet — Defender Quarantine Bait: EICAR ADS :WDFOO with Masqueraded wermgr.exe — Post-Exploitation · unlock with TL Creds
• 🔒 RoguePlanet — RP_<UUID> Staging Tree, ADS :WDFOO, and Junction Creation — Post-Exploitation Staging · unlock with TL Creds
• 🔒 RoguePlanet — Named Pipe [indicator] C2/IPC Channel · unlock with TL Creds

Indicators of compromise for RoguePlanet Malware Protection Engine LPE

As of 2026-07-10, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-0835.

Sample indicators (2 of 24)

• Domain: projectnightcrawler[.]dev
• Domain: deadeclipse666[.]blogspot[.]com

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How RoguePlanet Malware Protection Engine LPE works

A public proof-of-concept released by researcher 'Nightmare Eclipse' works on fully patched Windows 10 and Windows 11 (including the June 2026 Patch Tuesday build with KB5094126) regardless of real-time protection state.

CVE-2026-50656, publicly dubbed 'RoguePlanet', is an elevation-of-privilege zero-day in the Microsoft Malware Protection Engine that powers Microsoft Defender. The root cause is a Time-of-Check-to-Time-of-Use (TOCTOU) race condition (CWE-367) combined with improper link resolution before file access (CWE-59): Defender validates a file path and then performs a separate, non-atomic remediation/write as SYSTEM, and an unprivileged attacker redirects the write between those two steps using NTFS path-redirection objects — directory junctions (mount points) and reparse points — so a controlled path resolves to a protected destination.

The published PoC implements a seven-stage chain in which every individual component is a legitimate Windows feature and the vulnerability lives only in the sequence. A self-referential dual-mode binary checks IsRunningAsLocalSystem at entry; in unprivileged mode it acts as orchestrator, in SYSTEM mode it delivers a payload over a named pipe. A high-throughput I/O saturation engine (nicknamed 'Poseidon' — one generator thread plus one worker thread per logical core writing random data to UUID-named temp files) makes the opportunistic-lock (oplock) race windows deterministic rather than probabilistic. The exploit stages an embedded ISO containing a benign-looking wermgr.exe carrying the EICAR test signature inside a working directory at %TEMP%\RP_<UUID>\ with a fake System32 subtree, writes the EICAR content into an NTFS Alternate Data Stream named :WDFOO via low-level NT APIs, polls the \Device NT object directory for new HarddiskVolumeShadowCopy* devices created during Defender remediation, and places an oplock on the VSS-accessed ADS path to pause Defender mid-operation. A junction-swap chain then repoints the fake System32 directory to the mounted ISO and subsequently to a writable wdtest_temp directory, byte-range-locking the ISO's wermgr.exe so Defender is forced to create a quarantine placeholder in attacker-controlled space — yielding a SYSTEM-owned file in attacker-controlled territory. The attacker overwrites that captured quarantine artifact with the exploit binary, atomically renames artifacts to random UUID paths preserving open handles, and converts %TEMP%\RP_<UUID> into a junction targeting C:\Windows so that %TEMP%\RP_<UUID>\System32\wermgr.exe becomes path-equivalent to C:\Windows\System32\wermgr.exe. Finally the orchestrator uses the Task Scheduler COM interface to trigger the Windows Error Reporting 'QueueReporting' scheduled task — which runs as SYSTEM and is triggerable by unprivileged users — causing wermgr.exe to execute the attacker binary, which connects back over the \\.\pipe\RoguePlanet named pipe and spawns an interactive conhost.exe/cmd.exe in the user session at SYSTEM integrity.

RoguePlanet is the latest release in the 'Nightmare Eclipse' campaign (aliases Chaotic Eclipse / Dead Eclipse, handle MSNightmare), an anonymous researcher running an aggressive, roughly-every-10-day cadence of Defender and Windows zero-days characterized by the security press as retaliation over Microsoft's disclosure and bounty handling. It follows BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586) and a MiniPlasma regression, and was specifically reworked to bypass Microsoft's mid-May 2026 silent hardening of the mpengine!SysIO* API family. The exploit is race-dependent (near-100% reliability on some hardware, near-useless on others), does not work on Windows Server (standard users cannot mount ISOs), and requires Defender real-time protection plus WER infrastructure enabled. Microsoft has confirmed it is investigating and preparing a security update; no patch addressing the root cause existed at disclosure. ThreatLocker independently reproduced the exploit and reported that default application allowlisting (WDAC/AppLocker enforced mode) prevents execution. While RoguePlanet's PoC was unconfirmed in active attacks at publication, Huntress reported earlier Nightmare Eclipse tooling (BlueHammer, RedSun, UnDefend) operationalized in live intrusions, indicating near-term weaponization risk.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1211 Exploitation for Stealth; T1480 Execution Guardrails; T1564 Hide Artifacts

Execution

T1053 Scheduled Task/Job; T1203 Exploitation for Client Execution; T1559 Inter-Process Communication

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

lateral-movement

T1080 Taint Shared Content

Discovery

T1082 System Information Discovery; T1518 Software Discovery

execution

T1204 User Execution

defense-impairment

T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools

Impact

T1486 Data Encrypted for Impact

Persistence

T1543 Create or Modify System Process

stealth

T1574 Hijack Execution Flow

Resource Development

T1588 Obtain Capabilities

Remediation for RoguePlanet Malware Protection Engine LPE

Patches

• Apply the Microsoft Malware Protection Engine update for CVE-2026-50656 once released (engine auto-updates via Defender platform); monitor MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Immediate actions

• Deploy detection for any interactive shell (cmd.exe/powershell.exe/conhost.exe) whose parent is MsMpEng.exe at SYSTEM integrity — a lineage that should never occur in a healthy environment
• Hunt for the named pipe \\.\pipe\RoguePlanet (no legitimate software uses it)
• Hunt for %TEMP%\RP_<UUID>\ working directories and wermgr.exe executing from non-system directories

Workarounds

• Restrict mounting of .vhd/.vhdx/.iso images from email and network locations
• Verify NTFS symlink evaluation is disabled (fsutil behavior query SymlinkEvaluation — ensure R2L/R2R disabled)
• Block outbound SMB (TCP/445, TCP/139) to untrusted hosts to cut the related remote attack surface

Longer-term hardening

• Enforce application allowlisting in enforced mode (WDAC/AppLocker) — ThreatLocker reproduced the exploit and confirmed default allowlisting blocks it
• Enforce least privilege to shrink the unprivileged-user foothold population
• Deploy behavioral detection for reparse-point/junction creation in %TEMP%/%LOCALAPPDATA%/C:\ProgramData and VSS enumeration from non-system processes

Affected and fixed versions

• Microsoft — Microsoft Malware Protection Engine (mpengine)
  Vulnerable versions: mpengine prior to fixed engine for CVE-2026-50656
  Fixed in: engine update forthcoming per MSRC
• Microsoft — Windows 10
  Vulnerable versions: fully patched incl. June 2026 Patch Tuesday
  Fixed in: pending Defender engine update
• Microsoft — Windows 11
  Vulnerable versions: fully patched incl. June 2026 Patch Tuesday (KB5094126), stable and Canary Insider Preview
  Fixed in: pending Defender engine update
• Microsoft — Microsoft Defender Antivirus (WinDefend / MsMpEng.exe)
  Vulnerable versions: real-time protection enabled
  Fixed in: pending Defender engine update

Timeline of RoguePlanet Malware Protection Engine LPE

Last updated 2026-07-10 · 2 updates · revalidated 2× · latest source

• 2026-04-01 Nightmare Eclipse campaign of recurring Microsoft Defender/Windows zero-days begins, cadence roughly one new release every ~10 days.
• 2026-04-14 BlueHammer (CVE-2026-33825, CVSS 7.8), the earlier Defender path-redirection exploit in the same campaign, is disclosed and patched.
• 2026-05-15 Microsoft silently hardens the mpengine!SysIO* API family to disrupt path-redirection attacks against Defender.
• 2026-05-21 RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) Defender exploits in the same campaign are patched.
• 2026-05-23 GitHub removes the researcher's repositories; copies spread to forums, paste sites, and alternative Git hosts.
• 2026-05-26 GitLab removes the researcher's repositories, prompting a move to self-hosted locked-ioc-18.
• 2026-06-09 June 2026 Patch Tuesday fixes YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586), and the MiniPlasma regression.
• 2026-06-10 locked-ioc-23 released hours after Patch Tuesday, reworked to bypass the mid-May mpengine!SysIO* hardening; works on fully patched Windows 10/11 (validated against KB5094126).
• 2026-06-16 CVE-2026-50656 published (NVD/MSRC) with CVSS 7.8 and CWE-59; Microsoft confirms investigation and an update is forthcoming.
• 2026-06-17 BleepingComputer reports Microsoft is working on a high-quality Defender security update; no patch available at time of reporting.
• 2026-06-18 Qualys reports RoguePlanet (CVE-2026-50656) being exploited in attacks against fully patched Windows 10/11 hosts, corroborating the record's existing ACTIVE exploitability status.
• 2026-06-18 Qualys ThreatPROTECT publishes analysis and assigns detection QID 92413; notes no confirmed in-the-wild exploitation at that time.
• 2026-06-25 Kudelski Security confirms exploit mechanics as a TOCTOU race in the Malware Protection Engine's file-processing workflow and notes Windows Server exploitation requires PoC redesign due to ISO-mounting restrictions.
• 2026-07-08 Microsoft releases Malware Protection Engine version 1.1.26060.3008, remediating CVE-2026-50656.
• 2026-07-09 Security media (Help Net Security, BleepingComputer, SecurityWeek, Security Affairs) widely report the RoguePlanet patch release.

Update history

• 2026-07-10 — CVE-2026-50656: Privilege Escalation Race Condition in Microsoft Malware Protection Engine (RoguePlanet): What changed No escalation of severity_level, exploitability, status, cvss_score, or attribution needed — the existing record already reflects ACTIVE exploitability and PATCHED status (MPE 1.1.26060.3008) from a prior revalidation using the
• 2026-07-10 — RoguePlanet: Microsoft Defender Malware Protection Engine Local Privilege Escalation (CVE-2026-50656): What changed Status ACTIVE → PATCHED: Microsoft shipped Malware Protection Engine 1.1.26060.3008 on 2026-07-08/09 remediating CVE-2026-50656, roughly a month after the original PoC/CVE disclosure. Severity/exploitability/CVSS unchanged (sti

Sources cited for RoguePlanet Malware Protection Engine LPE

• NVD - CVE-2026-50656 NVD (NIST) · Advisory · 2026-06-16
• MSRC Security Update Guide - CVE-2026-50656 Microsoft Security Response Center · Vendor report · 2026-06-16
• RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day picussecurity.com · Research · 2026-06-16
• RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline cyderes.com · Research · 2026-06-10
• MSNightmare/RoguePlanet PoC repository (PoC-distribution infrastructure) GitHub · Proof of concept · 2026-06-10
• Microsoft working on Defender patch for RoguePlanet zero-day BleepingComputer · News · 2026-06-17
• Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows The Hacker News · News · 2026-06-16
• Nightmare Eclipse drops RoguePlanet zero-day after Patch Tuesday cybernews.com · News · 2026-06-16
• Nightmare Eclipse Drops Yet Another MSFT Exploit, RoguePlanet Dark Reading · News · 2026-06-16
• New Windows Defender 0-Day Exploit RoguePlanet Grants SYSTEM Access cybersecuritynews.com · News · 2026-06-16

Threats related to RoguePlanet Malware Protection Engine LPE

• LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
• ShieldBreak: Windows Defender Cloud-Hydration Zero-Day Bypasses RoguePlanet Patch (CVE-2026-50656) for SYSTEM-Level Privilege Escalation
• NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
• RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
• LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting

Related coverage of this activity

• RoguePlanet Defender zero-day
• LegacyHive profsvc hive hijack
• LegacyHive ProfSvc privilege escalation
• PixelSmash FFmpeg MagicYUV decoder
• CHARON ptrace fd theft