ShieldBreak is a Windows proof of concept from Nightmare-Eclipse that chains Cloud Files, Object Manager manipulation, Defender APIs, and a timing race to achieve local privilege escalation on fully patched Windows systems. It ultimately writes an attacker-controlled DLL to C:WindowsSystem32phoneinfo.dll and triggers SYSTEM code execution through the Windows Error Reporting QueueReporting task. #NightmareEclipse #ShieldBreak #phoneinfo.dll #MpClient.dll #QueueReporting
Keypoints
- ShieldBreak is the latest Nightmare-Eclipse Windows PoC, released after Microsoft’s August 2026 Patch Tuesday.
- The exploit works from a standard user account on Windows 11 24H2 and Windows Server 2025 with Defender in default configuration.
- It combines Cloud Files sync root abuse, NT Object Manager namespace redirection, direct Defender API calls, and a TOCTOU race.
- The PoC redirects Defender’s clean engine to write an attacker-supplied DLL to C:WindowsSystem32phoneinfo.dll.
- Execution is achieved when the QueueReporting Windows Error Reporting task loads the planted DLL as SYSTEM.
- Defenders are advised to hunt for behavioral chains rather than any single indicator, especially MpClient.dll loading, WD_SCAN symlink activity, and unexpected phoneinfo.dll creation.
- The report provides YARA content and SentinelOne hunting queries to detect the PoC and related behaviors.
MITRE Techniques
- [T1068] Exploitation for Privilege Escalation – The PoC abuses a Windows Defender pipeline flaw to move from standard user to SYSTEM (‘runs to full SYSTEM completion from a standard user account’).
- [T1574.002] DLL Side-Loading – The attacker plants phoneinfo.dll in System32 and has wermgr.exe load it (‘wermgr.exe to process the report, loading phoneinfo.dll from System32’).
- [T1218] Signed Binary Proxy Execution – A trusted signed Windows binary is used as the execution vehicle (‘wermgr.exe (signed) used as SYSTEM execution vehicle’).
- [T1053.005] Scheduled Task/Job: Scheduled Task – QueueReporting is triggered through Task Scheduler COM to run as SYSTEM (‘Trigger QueueReporting through Task Scheduler COM’).
- [T1562.001] Impair Defenses: Disable or Modify AV – Defender’s clean engine is weaponized to write the payload (‘Windows Defender’s own clean engine is redirected’).
- [T1106] Native API – The PoC resolves and uses native Windows APIs such as NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject (‘dynamically resolves the native NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject APIs’).
- [T1070.004] Indicator Removal: File Deletion – The workdir and WER artifacts are removed after use (‘post-exploitation cleanup of workdir, WER artifacts’).
- [T1036.005] Masquerading: Match Legitimate Name – The fake Cloud Files provider impersonates a sync service (‘provider identifies itself as “Flubber”‘).
Indicators of Compromise
- [File paths] Payload destination and staging paths – C:WindowsSystem32phoneinfo.dll, C:ShieldBreak_, and C:ProgramDataMicrosoftWindowsWERReportQueueKernel_c0000000_A_B_C-C-D-E-
- [File names] Dropped and referenced artifacts – ShieldBreak.exe, phoneinfo.dll, BERLIN, and Report.wer
- [Named pipes] Callback channel used after SYSTEM execution – ??pipeSHIELDBREAK
- [GUIDs] Hardcoded or reusable identifiers in the PoC – B196E670-59C7-4D41-9637-C62D80541321 and GUID-suffixed working/report directories
- [Registry / namespace paths] Object Manager redirection targets – BaseNamedObjectsRestrictedWD_SHADOW_ and WD_SCAN
- [Domains / local UNC paths] Redirected destination used during the race – ??UNC127.0.0.1C$WindowsSystem32phoneinfo.dll
- [DLLs] Frequently loaded or suspicious modules – MpClient.dll, CldApi.dll, and wermgr.exe-associated phoneinfo.dll loading context
MITRE Techniques
- [T1105] Ingress Tool Transfer – Embedded ZIP and DLL resources are extracted locally for later use (‘extracts embedded ZIP and DLL resources’).
- [T1057] Process Discovery – The PoC relies on identifying and interacting with Defender-related processes during the chain (‘expected processes include MsMpEng.exe, MpCmdRun.exe, NisSrv.exe’).
- [T1027] Obfuscated Files or Information – The attack uses staged content changes and hidden working resources to conceal the payload flow (‘hidden working directory at the root of C:’).
Indicators of Compromise
- [API / module names] Defender and Object Manager functions resolved at runtime – MpManagerOpen, MpScanStart, MpCleanOpen, NtCreateDirectoryObjectEx, NtCreateSymbolicLinkObject
- [Cloud Files artifacts] Sync root and placeholder creation – CfRegisterSyncRoot, CfCreatePlaceholders, CfExecute, and provider name Flubber
- [Task Scheduler / WER artifacts] Execution trigger and report queue items – QueueReporting, Windows Error Reporting, and ReportQueue