Analytics Story: RoguePlanet

Updated Date: 2026-08-17 ID: eafb5ab2-71bb-4da9-a541-015d002f01f1 Author: Teoderick Contreras, Onur Mustafa Erdogan, Splunk Product: Splunk Enterprise Security

Description

RoguePlanet is a publicly released proof-of-concept exploit targeting a race condition in Microsoft Windows Defender. The attack abuses Defender scanning behavior, NTFS alternate data streams, virtual ISO mounting, volume shadow copy paths, and opportunistic oplocks to achieve local privilege escalation to SYSTEM. Successful exploitation spawns a privileged shell. The PoC has been tested on Windows 10 and Windows 11 client builds with current patches as of mid-2026; standard users cannot mount ISO images on Windows Server, though the underlying vulnerability is believed to affect server platforms as well.

Why it matters

RoguePlanet, published by MSNightmare, is a Windows Defender local privilege escalation exploit built around a race condition. Unlike traditional service abuse or token manipulation chains, this attack weaponizes Defender's own scanning pipeline. The exploit is probabilistic — success rates vary by host — but when it lands, the attacker obtains a SYSTEM-level shell.

The attack begins when a low-privileged user executes RoguePlanet.exe, typically from a user-writable location such as a public tools directory or downloads folder. The binary creates a working directory under %TEMP% using the RP_ prefix, mounts an embedded ISO image through the Windows Virtual Disk API, and stages a malicious payload disguised as wermgr.exe. A distinctive hallmark of the exploit is creation of an NTFS alternate data stream named :WDFOO on that file. The PoC also writes EICAR-like content to trigger an on-access scan by MsMpEng.exe.

To win the race, RoguePlanet uses opportunistic oplocks, directory junctions, and volume shadow copy paths. It opens handles against shadow-copy-resolved paths such as ...\wermgr.exe:WDFOO, requests oplocks, and coordinates file supersede and rename operations while Defender is actively scanning the staged content. A named pipe at \.\pipe\RoguePlanet is used to synchronize the final SYSTEM-context stage. When the race succeeds, the elevated instance launches an interactive console in the originating user session.

From a detection standpoint, the most durable observables are Sysmon Event ID 15 records showing :WDFOO alternate data streams on wermgr.exe under RP_* temp directories, MsMpEng.exe touching those same paths, and the initial RoguePlanet.exe process writing ADS content. Secondary signals include creation of RP_* directories, virtual disk attach activity, reparse-point manipulation, and a user-context process later spawning SYSTEM-integrity children.

ShieldBreak is a related proof-of-concept published by NightmareEclipse that exploits the same underlying weakness in Defender's scanning pipeline, targeting Windows Server 2025 rather than client builds. A low-privileged executable creates a working directory under C:\ShieldBreak_{GUID}, registers a fake cloud storage provider, and creates a cloud file placeholder named BERLIN with a stream ADS. It loads mpclient.dll, Defender's own client API library, and directs Defender to scan a path resolved through the object manager under \BaseNamedObjects\Restricted, hydrating the placeholder on demand.

ShieldBreak wins its race through symbolic link manipulation rather than oplocks: an object-manager symlink initially resolves the scan target to the working directory, then is swapped to resolve through a CLFS path so that a locked Defender artifact file (BERLIN.blf) is produced instead. A second symbolic link, created over a local administrative share targeting 127.0.0.1, redirects that locked file to \Windows\System32\phoneinfo.dll, so the subsequent hydration writes the attacker's payload directly into a privileged system directory. The exploit then fabricates a Windows Error Report under the WER ReportQueue directory and manually executes the QueueReporting scheduled task, causing wermgr.exe to load phoneinfo.dll -- a classic phantom-DLL hijack target -- which steals a SYSTEM token and spawns an elevated shell.

This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file and module-load activity, Windows Error Reporting abuse, and privilege escalation patterns consistent with RoguePlanet, ShieldBreak, and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Wermgr Alternate Data Stream in Temp Dir	NTFS File Attributes	Anomaly
Windows App Layer Protocol Wermgr Connect To NamedPipe	Application Layer Protocol	Anomaly
Windows Error Report Created in ReportQueue Manually	Scheduled Task, Exploitation for Privilege Escalation	Anomaly
Windows Defender MpClient.dll Loaded by Non-Defender Process	Exploitation for Privilege Escalation	Anomaly
Windows Process Execution in Temp Dir	Match Legitimate Resource Name or Location, Create or Modify System Process	Anomaly
Windows Defender Threat Detected on Kernel Object Path	Exploitation for Privilege Escalation, Exploitation for Stealth	TTP
Windows Process Injection Wermgr Child Process	Process Injection	Anomaly
Windows Wermgr Spawning System Integrity Process	Exploitation for Privilege Escalation, Token Impersonation/Theft	TTP
Windows Phantom DLL Created on Disk	Exploitation for Privilege Escalation, DLL	TTP
Windows Alternate Data Stream Created Over Local Share	SMB/Windows Admin Shares, NTFS File Attributes	Anomaly
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Executables Or Script Creation In Temp Path	Masquerading	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 15	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Defender 1116	Windows	`XmlWinEventLog`	`WinEventLog:Microsoft-Windows-Windows Defender/Operational`
Windows Event Log Defender 1117	Windows	`XmlWinEventLog`	`WinEventLog:Microsoft-Windows-Windows Defender/Operational`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 2