# CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)

> RoguePlanet (CVE-2026-50656) is a Time-of-Check-to-Time-of-Use race condition in the Microsoft Malware Protection Engine (mpengine) that lets an unprivileged local user redirect a file operation performed by MsMpEng.exe (running as NT AUTHORITY\SYSTEM) using NTFS junctions and reparse points, ultimately executing attacker code as SYSTEM. A public proof-of-concept released by researcher 'Nightmare Eclipse' works on fully patched Windows 10 and Windows 11 (including the June 2026 Patch Tuesday build with KB5094126) regardless of real-time protection state.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-07-10T07:32:34.250Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0835
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rogueplanet-malware-protection-engine-lpe-tl-2026-0835.webp?v=8a0e6f41 (Threadlinqs threat intel: CVE-2026-50656 RoguePlanet Defender LPE: Detection & IOCs (TL-2026-0835) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-0835
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** Nightmare Eclipse
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (2 shown free below)
- **CVEs:** CVE-2026-50656

## Description

CVE-2026-50656, publicly dubbed 'RoguePlanet', is an elevation-of-privilege zero-day in the Microsoft Malware Protection Engine that powers Microsoft Defender. The root cause is a Time-of-Check-to-Time-of-Use (TOCTOU) race condition (CWE-367) combined with improper link resolution before file access (CWE-59): Defender validates a file path and then performs a separate, non-atomic remediation/write as SYSTEM, and an unprivileged attacker redirects the write between those two steps using NTFS path-redirection objects — directory junctions (mount points) and reparse points — so a controlled path resolves to a protected destination.

The published PoC implements a seven-stage chain in which every individual component is a legitimate Windows feature and the vulnerability lives only in the sequence. A self-referential dual-mode binary checks IsRunningAsLocalSystem at entry; in unprivileged mode it acts as orchestrator, in SYSTEM mode it delivers a payload over a named pipe. A high-throughput I/O saturation engine (nicknamed 'Poseidon' — one generator thread plus one worker thread per logical core writing random data to UUID-named temp files) makes the opportunistic-lock (oplock) race windows deterministic rather than probabilistic. The exploit stages an embedded ISO containing a benign-looking wermgr.exe carrying the EICAR test signature inside a working directory at %TEMP%\RP_<UUID>\ with a fake System32 subtree, writes the EICAR content into an NTFS Alternate Data Stream named :WDFOO via low-level NT APIs, polls the \Device NT object directory for new HarddiskVolumeShadowCopy* devices created during Defender remediation, and places an oplock on the VSS-accessed ADS path to pause Defender mid-operation. A junction-swap chain then repoints the fake System32 directory to the mounted ISO and subsequently to a writable wdtest_temp directory, byte-range-locking the ISO's wermgr.exe so Defender is forced to create a quarantine placeholder in attacker-controlled space — yielding a SYSTEM-owned file in attacker-controlled territory. The attacker overwrites that captured quarantine artifact with the exploit binary, atomically renames artifacts to random UUID paths preserving open handles, and converts %TEMP%\RP_<UUID> into a junction targeting C:\Windows so that %TEMP%\RP_<UUID>\System32\wermgr.exe becomes path-equivalent to C:\Windows\System32\wermgr.exe. Finally the orchestrator uses the Task Scheduler COM interface to trigger the Windows Error Reporting 'QueueReporting' scheduled task — which runs as SYSTEM and is triggerable by unprivileged users — causing wermgr.exe to execute the attacker binary, which connects back over the \\.\pipe\RoguePlanet named pipe and spawns an interactive conhost.exe/cmd.exe in the user session at SYSTEM integrity.

RoguePlanet is the latest release in the 'Nightmare Eclipse' campaign (aliases Chaotic Eclipse / Dead Eclipse, handle MSNightmare), an anonymous researcher running an aggressive, roughly-every-10-day cadence of Defender and Windows zero-days characterized by the security press as retaliation over Microsoft's disclosure and bounty handling. It follows BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586) and a MiniPlasma regression, and was specifically reworked to bypass Microsoft's mid-May 2026 silent hardening of the mpengine!SysIO* API family. The exploit is race-dependent (near-100% reliability on some hardware, near-useless on others), does not work on Windows Server (standard users cannot mount ISOs), and requires Defender real-time protection plus WER infrastructure enabled. Microsoft has confirmed it is investigating and preparing a security update; no patch addressing the root cause existed at disclosure. ThreatLocker independently reproduced the exploit and reported that default application allowlisting (WDAC/AppLocker enforced mode) prevents execution. While RoguePlanet's PoC was unconfirmed in active attacks at publication, Huntress reported earlier Nightmare Eclipse tooling (BlueHammer, RedSun, UnDefend) operationalized in live intrusions, indicating near-term weaponization risk.

## MITRE ATT&CK

- T1204 User Execution
- T1080 Taint Shared Content
- T1203 Exploitation for Client Execution
- T1053 Scheduled Task/Job
- T1559 Inter-Process Communication
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1564 Hide Artifacts
- T1222 File and Directory Permissions Modification
- T1211 Exploitation for Stealth
- T1480 Execution Guardrails
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1134 Access Token Manipulation
- T1003 OS Credential Dumping
- T1543 Create or Modify System Process
- T1518 Software Discovery
- T1021 Remote Services
- T1486 Data Encrypted for Impact
- T1588 Obtain Capabilities
- T1027 Obfuscated Files or Information
- T1570 Lateral Tool Transfer
- T1070 Indicator Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RoguePlanet — Interactive Shell Spawned by Defender Engine (MsMpEng.exe) — Exploitation** (`TL-2026-0835-SPL-001`)

Detects the primary RoguePlanet (CVE-2026-50656) SYSTEM-execution signal: an interactive shell or console host whose parent process is MsMpEng.exe (the Microsoft Malware Protection Engine running as NT AUTHORITY\SYSTEM). The TOCTOU/junction chain coerces Defender into executing the attacker's redirected wermgr.exe, which then spawns an interactive cmd.exe/powershell.exe/conhost.exe at SYSTEM integrity. This parent-child lineage should never occur in a healthy environment and is the highest-fidelity indicator of successful exploitation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1574, T1559
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\MsMpEng.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\conhost.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe")
| eval is_system=if(match(IntegrityLevel,"(?i)system") OR User="NT AUTHORITY\\SYSTEM",1,0)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(Image) as child_proc values(CommandLine) as cmdline values(IntegrityLevel) as integrity by Computer, ParentImage, User
| where count > 0
| convert ctime(firstSeen) ctime(lastSeen)
| sort - lastSeen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","conhost.exe","cscript.exe","wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessIntegrityLevel
| order by Timestamp desc
```

### Sigma

```yaml
title: RoguePlanet Interactive Shell Spawned by Defender Engine (MsMpEng.exe)
id: 7c1d4e90-0835-4a01-9b10-rp00000spl01
status: experimental
description: Detects an interactive shell or console host whose parent is MsMpEng.exe at SYSTEM integrity, the primary RoguePlanet (CVE-2026-50656) SYSTEM-execution signal. Should never occur in a healthy environment.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656
    - https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/17
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1574
    - attack.t1559
    - cve.2026.50656
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\MsMpEng.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\conhost.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    condition: selection
fields:
    - Image
    - ParentImage
    - IntegrityLevel
    - CommandLine
falsepositives:
    - Extremely rare Defender troubleshooting or support tooling that shells out; validate integrity level and command line.
level: critical
```

**Known false positives:**

- Rare Defender support or troubleshooting tooling that legitimately spawns a console; verify SYSTEM integrity and command line before escalating.

**Tuning notes:** This lineage is effectively never legitimate — alert at critical with no threshold. Optionally enrich with IntegrityLevel=System to remove any non-elevated edge cases, and pivot to the spawned child's own children to capture the follow-on interactive session.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RoguePlanet — wermgr.exe Execution Outside System32 via Junction Redirection — Exploitation (locked: unlock with TL Creds)
- RoguePlanet — WER QueueReporting Scheduled Task Triggered by Unprivileged User — Post-Exploitation (locked: unlock with TL Creds)
- RoguePlanet — Unexpected ISO/VHD Mount From Temp by Non-System User — Lateral Staging (locked: unlock with TL Creds)
- RoguePlanet — NTFS Junction / Reparse-Point Creation in User-Writable Paths — Exploitation Primitive (locked: unlock with TL Creds)
- RoguePlanet — NtQueryDirectoryObject VSS Enumeration + Poseidon I/O Saturation — Race Priming (locked: unlock with TL Creds)
- RoguePlanet — Defender Quarantine Bait: EICAR ADS :WDFOO with Masqueraded wermgr.exe — Post-Exploitation (locked: unlock with TL Creds)
- RoguePlanet — RP_<UUID> Staging Tree, ADS :WDFOO, and Junction Creation — Post-Exploitation Staging (locked: unlock with TL Creds)
- RoguePlanet — Named Pipe [indicator] C2/IPC Channel (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 24)

Defanged, TLP:CLEAR.

- Domain: `projectnightcrawler[.]dev`
- Domain: `deadeclipse666[.]blogspot[.]com`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Microsoft working on Defender patch for RoguePlanet zero-day](https://www.bleepingcomputer.com/news/microsoft/microsoft-working-on-defender-patch-for-rogueplanet-zero-day/)
- [NVD - CVE-2026-50656](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-50656)
- [MSRC Security Update Guide - CVE-2026-50656](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656)
- [RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day](https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day)
- [RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline](https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day)
- [Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows](https://thehackernews.com/2026/06/microsoft-defender-rogueplanet-zero-day.html)
- [Nightmare Eclipse drops RoguePlanet zero-day after Patch Tuesday](https://cybernews.com/security/nightmare-eclipse-rogueplanet-zero-day/)
- [Nightmare Eclipse Drops Yet Another MSFT Exploit, RoguePlanet](https://www.darkreading.com/vulnerabilities-threats/nightmare-eclipse-microsoft-exploit-rogueplanet)
- [New Windows Defender 0-Day Exploit RoguePlanet Grants SYSTEM Access](https://cybersecuritynews.com/windows-defender-0-day-exploit-rogueplanet/)
- [MSNightmare/RoguePlanet PoC repository (PoC-distribution infrastructure)](https://github.com/MSNightmare/RoguePlanet)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0835