LoFP LoFP / no false positives have been identified at this time. legitimate defender scans do not report detections against paths resolved through the nt object manager namespace.

Techniques

Sample rules

Windows Defender Threat Detected on Kernel Object Path

Description

The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot). It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender’s own scanning pipeline for local privilege escalation.

Detection logic

`ms_defender`
EventCode IN (1116, 1117)
Path="*\\globalroot\\*"

| fillnull

| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(EventCode) as EventCode
              values(Action_Name) as Action_Name
              values(Additional_Actions_String) as Additional_Actions_String
              values(FWLink) as FWLink
  by dvc Detection_User Path Threat_Name Severity_Name Category_Name

| rename dvc as dest, Detection_User as user

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_defender_threat_detected_on_kernel_object_path_filter`