ShieldBreak is a Windows proof of concept from Nightmare-Eclipse that chains Cloud Files, Object Manager manipulation, Defender APIs, and a timing race to achieve local privilege escalation on fully patched Windows systems. It ultimately writes an attacker-controlled DLL to C:WindowsSystem32phoneinfo.dll and triggers SYSTEM code execution through the Windows Error Reporting QueueReporting task. #NightmareEclipse #ShieldBreak #phoneinfo.dll #MpClient.dll #QueueReporting
Keypoints
- ShieldBreak is the latest Nightmare-Eclipse Windows PoC, released after Microsoftâs August 2026 Patch Tuesday.
- The exploit works from a standard user account on Windows 11 24H2 and Windows Server 2025 with Defender in default configuration.
- It combines Cloud Files sync root abuse, NT Object Manager namespace redirection, direct Defender API calls, and a TOCTOU race.
- The PoC redirects Defenderâs clean engine to write an attacker-supplied DLL to C:WindowsSystem32phoneinfo.dll.
- Execution is achieved when the QueueReporting Windows Error Reporting task loads the planted DLL as SYSTEM.
- Defenders are advised to hunt for behavioral chains rather than any single indicator, especially MpClient.dll loading, WD_SCAN symlink activity, and unexpected phoneinfo.dll creation.
- The report provides YARA content and SentinelOne hunting queries to detect the PoC and related behaviors.
MITRE Techniques
- [T1068] Exploitation for Privilege Escalation â The PoC abuses a Windows Defender pipeline flaw to move from standard user to SYSTEM (âruns to full SYSTEM completion from a standard user accountâ).
- [T1574.002] DLL Side-Loading â The attacker plants phoneinfo.dll in System32 and has wermgr.exe load it (âwermgr.exe to process the report, loading phoneinfo.dll from System32â).
- [T1218] Signed Binary Proxy Execution â A trusted signed Windows binary is used as the execution vehicle (âwermgr.exe (signed) used as SYSTEM execution vehicleâ).
- [T1053.005] Scheduled Task/Job: Scheduled Task â QueueReporting is triggered through Task Scheduler COM to run as SYSTEM (âTrigger QueueReporting through Task Scheduler COMâ).
- [T1562.001] Impair Defenses: Disable or Modify AV â Defenderâs clean engine is weaponized to write the payload (âWindows Defenderâs own clean engine is redirectedâ).
- [T1106] Native API â The PoC resolves and uses native Windows APIs such as NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject (âdynamically resolves the native NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject APIsâ).
- [T1070.004] Indicator Removal: File Deletion â The workdir and WER artifacts are removed after use (âpost-exploitation cleanup of workdir, WER artifactsâ).
- [T1036.005] Masquerading: Match Legitimate Name â The fake Cloud Files provider impersonates a sync service (âprovider identifies itself as âFlubberââ).
Indicators of Compromise
- [File paths] Payload destination and staging paths â C:WindowsSystem32phoneinfo.dll, C:ShieldBreak_, and C:ProgramDataMicrosoftWindowsWERReportQueueKernel_c0000000_A_B_C-C-D-E-
- [File names] Dropped and referenced artifacts â ShieldBreak.exe, phoneinfo.dll, BERLIN, and Report.wer
- [Named pipes] Callback channel used after SYSTEM execution â ??pipeSHIELDBREAK
- [GUIDs] Hardcoded or reusable identifiers in the PoC â B196E670-59C7-4D41-9637-C62D80541321 and GUID-suffixed working/report directories
- [Registry / namespace paths] Object Manager redirection targets â BaseNamedObjectsRestrictedWD_SHADOW_ and WD_SCAN
- [Domains / local UNC paths] Redirected destination used during the race â ??UNC127.0.0.1C$WindowsSystem32phoneinfo.dll
- [DLLs] Frequently loaded or suspicious modules â MpClient.dll, CldApi.dll, and wermgr.exe-associated phoneinfo.dll loading context
MITRE Techniques
- [T1105] Ingress Tool Transfer â Embedded ZIP and DLL resources are extracted locally for later use (âextracts embedded ZIP and DLL resourcesâ).
- [T1057] Process Discovery â The PoC relies on identifying and interacting with Defender-related processes during the chain (âexpected processes include MsMpEng.exe, MpCmdRun.exe, NisSrv.exeâ).
- [T1027] Obfuscated Files or Information â The attack uses staged content changes and hidden working resources to conceal the payload flow (âhidden working directory at the root of C:â).
Indicators of Compromise
- [API / module names] Defender and Object Manager functions resolved at runtime â MpManagerOpen, MpScanStart, MpCleanOpen, NtCreateDirectoryObjectEx, NtCreateSymbolicLinkObject
- [Cloud Files artifacts] Sync root and placeholder creation â CfRegisterSyncRoot, CfCreatePlaceholders, CfExecute, and provider name Flubber
- [Task Scheduler / WER artifacts] Execution trigger and report queue items â QueueReporting, Windows Error Reporting, and ReportQueue