The case follows five ShieldBreak actions, from delivery of an attacker-controlled file to the reported SYSTEM execution. It starts with the attacker already able to run code as a normal user and ends at privilege escalation.
The model treats content substitution and path redirection as separate contributions to the final action. Their necessity is inferred from the case records and remains untested.
Assumptions
The displayed connections capture selected dependencies. A connection shows that one action supplies a condition needed by another; establishing a complete executable path requires checking the remaining conditions.
Initial access and activity after escalation are outside the model. The Environment overview also includes illustrative systems, labeled where they appear.
The case contains no direct execution trace or measured defense test. Current patch status is outside this dated snapshot.
Five authored actions and two unmodeled boundaries: M0 (initial access) and M6 (activity after escalation). The content-substitution and object-path contributions are unordered and jointly required by the final authored action.
The fuller model records normal-user execution as a shared requirement of nine actions: five ShieldBreak actions and four RoguePlanet actions. This provisional grouping is available in the formal model.
Try a different assumption
Make a condition unavailable, challenge a claim, or set aside a source. Every view follows the same scenario.
- Make a condition unavailable: the model marks each action that depends on it.
- Challenge a claim: the claim and dependent explanations are marked as questioned.
- Set aside a source: each claim that cited it loses that supporting material.
How to read the result
Blocked in this scenario means an action is missing a condition under the selected assumptions. It is a statement about the prepared model, not about a live system. A challenged claim carries a Challenged badge; the challenge marks the claim for scrutiny and does not show it to be false. A set-aside source leaves the claims that cited it with less retained support, and that loss does not show those claims to be false either.
These controls explore the prepared model. Testing a defense on a real system requires a separate experiment.
Detailed scenario rules
The source links are a curated presentation mapping.
A claim retains presentation support when at least one mapped available source remains and the claim is not challenged. The demo propagates weakened justification through its illustrative prerequisite graph. This scenario behavior is not formal inference, disproof or a computed reachability result.
The what-if workbench stacks assumed prerequisite blocks, claim challenges and source withdrawals. Its illustrative dependency rules carry consequences through M0 → M1 → M2 → {M3, M4} → M5; M3 and M4 remain unordered and jointly required. Undo and reset affect only the local scenario. No measured control result or complete formal reachability analysis is implied; M0 and M6 remain unmodeled stubs.
Simplified partial graph: an edge can carry one requirement; it does not establish complete prerequisite satisfaction or reachability.
Sources and access
Read the citations and retained excerpts behind each claim. Source entries identify whether the archive recorded full-text access, an excerpt, a repository description, or an unavailable document. Original full texts are not bundled with this walkthrough.
These sources are linked to this claim. Each entry shows the material available for review. Several sources may repeat the same underlying account.
Available means retained in this prepared support map. Documentation and exploit-code slots are illustrative gaps. External links need a network connection.
Threat report
qualys → S01 · Archived full-text label
Full text retrieved on September 5, 2026. Published reporting used for the ShieldBreak case and its prerequisites. This is a secondary report rather than a direct measurement in a user environment.
Exact registry citation: Sheel, Vamika. "CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days." Qualys Blog, 25 August 2026, updated 3 September 2026.
Archived retrieval: full text retrieved 2026-09-05
Archived reference excerpt · Source register · S01 · External cited source
Technical analysis
cryptron → S17 · Search excerpt only
Search excerpt only. Direct retrieval was refused. The case ledger uses excerpts describing the content and path changes during the security engine remediation. The full document was not independently retrieved.
Exact registry citation: "ShieldBreak In-Depth Analysis." CRYPTRON Security GmbH, August 2026. Source for the phase sequence: detected test content served first, payload served on restart hydration, Object Manager links redirected concurrently. Direct retrieval refused by the site's robots policy; search excerpt only.
Archived retrieval: search excerpt only, retrieval refused
Archived reference excerpt · Source register · S17 · External cited source
Reported confirmation
dormann → S06 · Reported confirmation
Reported by BleepingComputer; source excerpt only. A secondary report carries a reported confirmation of exploitation and the enabled security-engine condition. It does not independently validate each authored requirement.
Exact registry citation: "Microsoft working on Defender patch for ShieldBreak zero-day." BleepingComputer, August 2026. Carries Will Dormann's confirmation that the exploit works and that Defender must be enabled.
Archived retrieval: search excerpt only
Archived reference excerpt · Source register · S06 · External cited source
Related incident
related → S04 · RoguePlanet comparison
Comparative reporting, search excerpt only. A second privilege-escalation case involving the security engine supplies the contrast that reveals mechanism variants. It is not a direct observation of ShieldBreak.
Exact registry citation: "ShieldBreak bypasses Microsoft's patch for earlier Defender flaw." Malwarebytes Labs, August 2026.
Archived retrieval: search excerpt only
Archived reference excerpt · Source register · S04 · External cited source
Public PoC listing
repo → S08 · Description only
Repository description only; exploit material not read. The existence of the published ShieldBreak repository was noted in the ledger, but the code itself was not inspected. This node does not supply technical claims in the visualization.
Exact registry citation: MSNightmare. "ShieldBreak: Windows Defender 0day vulnerability." GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced.
Archived retrieval: repository description only
Archived reference excerpt · Source register · S08 · External cited source
System documentation
docs → illustrative slot · Not separately ingested
No separately inspected platform documentation in this corpus. The model describes Cloud Files API and Object Manager behaviors using public case reporting. This illustrative source slot is empty; do not mistake it for verified documentation.
Exact registry citation: Illustrative empty source slot; no registry record.
Archived retrieval: not inspected
Exploit source code
code → illustrative slot · Not inspected
No exploit binary or implementation inspected. The original case explicitly excludes code inspection. The graph retains this as a missing source, not as corroboration.
Exact registry citation: Illustrative empty source slot; no registry record.
Archived retrieval: not inspected
Vendor advisory
vendor → S15 · Not retrieved directly
Advisory entry not retrieved directly in this archive. Advisory status is carried as reported by external sources. This snapshot should not be read as a live patch-status assertion.
Exact registry citation: Microsoft Security Response Center. Security Update Guide entry for CVE-2026-69414. Not retrieved directly; status as reported by references 1 and 9.
Archived retrieval: not retrieved
Archived reference excerpt · Source register · S15 · External cited source
Claims and their sources
Normal-user execution
Required starting condition
The modeled escalation starts from code already running as a normal user. How the attacker acquired that ability is not described.
Initial access is unmodeled (M0). Normal-user execution is required by all five displayed authored records and nine observed C0 members.
Source aliases: qualys. Supports records: M0, M1, M2, M3, M4, M5.
S01 · archived reference
Cloud-file control
Callback ownership
The authored model represents a cloud-backed file whose hydration is controlled by the attacker.
A modeled state condition; no live platform verification was performed.
Source aliases: qualys, cryptron. Supports records: M1, M2, M3.
S01 · archived reference · S17 · archived reference
Privileged scan
Engine on attacker path
Published reporting describes the security engine acting on the attacker-controlled path, with real-time protection running.
The case treats this as a prerequisite; it does not assert that telemetry was collected.
Source aliases: qualys, dormann. Supports records: M2, M3, M4.
S01 · archived reference · S06 · archived reference
Content not rechecked
Detection ≠ remediation read
The model places this content revalidation gap in the platform: the engine checks one version and acts on another.
No defender-reachable configuration was identified for this mechanism in the September 2026 ledger.
Source aliases: qualys, cryptron. Supports records: M3, M5.
S01 · archived reference · S17 · archived reference
Target path not rechecked
Object Manager variation
The Object Manager path is represented as a distinct check-versus-use variation rather than merged with file content or NTFS junction behavior.
The evidence source is an excerpt; withdrawal leaves this presentation without retained support.
Source aliases: cryptron. Supports records: M4, M5.
S17 · archived reference
Privileged write target
Attacker-chosen destination
The model attributes the write-target redirection to a separate path-resolving mechanism.
A conclusion supported through modeled dependencies, not a measured write trace.
Source aliases: qualys, cryptron. Supports records: M4, M5.
S01 · archived reference · S17 · archived reference
SYSTEM outcome
Reported privilege elevation
The sources describe code running with SYSTEM privileges; the authored model records this as the M5 outcome. No independent execution was performed.
No post-escalation actions are part of this authored case.
Source aliases: qualys, dormann. Supports records: M5, M6.
S01 · archived reference · S06 · archived reference
Formal records and model boundaries
Each action's record carries its requirements (the formal name for the conditions the action needs), its mechanism (what the action does), and its resulting state. The records keep their identifiers and exact formal fields.
The records also retain provenance information. Asserted means an author wrote the field from the sources. Derived marks a conclusion drawn from other records; the archived label alone does not establish that a rule was executed. Authored requirements are asserted; the necessity of each one is inferred from the case records and has not been tested. Three kinds of record carry derived provenance in the archive, and the walkthrough keeps that marking. A grouping collects actions that share one pattern. A dependency edge shows one action supplying a condition another needs. A defensive profile records where a defense could act on one action.
M0 · Prior local execution
Entry not modeled · Unmodeled stub
The corpus deliberately starts with an unmodeled entry step. This is not an initial-access technique assignment.
- P · Needs
- The attacker can log in locally, or already has a way to run code as a normal user.
- M · Changes
- Not covered here. No source says how this happens.
- Q · Leaves behind
- The attacker can run code as a normal user.
Exact canonical formal P / M / Q
- P · Preconditions
- M · Mechanism
- Q · Postconditions
Presentation claim dependencies: Normal-user execution.
Fuller public model · record M0
No curated archived excerpt is supplied for this record; consult its full public model entry.
M1 · Supply a cloud-backed file
Sync root + hydration · Authored record
Creates the dependency later consumed by the privileged scan and content branch.
- P · Needs
- The attacker can run code as a normal user. The modeled operating system has the cloud-files driver, which is standard. A normal user is allowed to register a cloud-sync folder.
- M · Changes
- Register a sync folder and a placeholder file using the cloud-files API of the modeled operating system. Point the file's download handler at the attacker's own process.
- Q · Leaves behind
- When anything opens that file, the attacker's process decides what it gets.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ usercloudFilesFilter ⊒ presentsyncRootRegistration ⊒ permittedToUser
- M · Mechanism
register a sync root and a placeholder file through the Cloud Filter APIbind a hydration callback that runs in the adversary's own user-mode process
- Q · Postconditions
hydrationCallbackOwner = adversary
Presentation claim dependencies: Cloud-file control, Normal-user execution.
Fuller public model · record M1
No curated archived excerpt is supplied for this record; consult its full public model entry.
M2 · Induce a privileged scan
Privileged engine reads the path · Authored record
This creates a point of contact between user-controlled input and the privileged engine.
- P · Needs
- The attacker can run code as a normal user. The attacker's process controls what that file returns when read. The security engine is running. A normal user can ask the security engine to scan something.
- M · Changes
- Ask the security engine to scan the folder, using the same interface any user program can call.
- Q · Leaves behind
- The security engine is now reading a path the attacker set up, and it is running as SYSTEM.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ userhydrationCallbackOwner = adversarydefenderRealtime ⊒ enabledscanRequestInterface ⊒ callableByUser
- M · Mechanism
call the Defender client interface to open the manager and start a resource scan against the prepared path
- Q · Postconditions
scannerAttention = onAdversaryPath
Presentation claim dependencies: Privileged scan, Normal-user execution, Cloud-file control.
Fuller public model · record M2
No curated archived excerpt is supplied for this record; consult its full public model entry.
M3 · Substitute the file contents
Content substitution · Authored record
The content variation is modeled separately from path-target redirection.
- P · Needs
- The attacker can run code as a normal user. The attacker's process decides what the security engine reads from that file. The security engine is scanning the attacker's path as SYSTEM. The security engine does not re-check the contents before acting on them.
- M · Changes
- Hand the security engine a file it will flag, so it starts cleaning it up. Hand it different contents when it reads the file again during cleanup.
- Q · Leaves behind
- The security engine is now working on bytes the attacker chose, with SYSTEM rights.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ userhydrationCallbackOwner = adversaryscannerAttention = onAdversaryPathcontentRevalidation = absent
- M · Mechanism
serve detected test content on the first hydration, so the engine enters remediationserve different content on the restart hydration that the remediation read triggers
- Q · Postconditions
privilegedProcessInput = adversaryControlled
Presentation claim dependencies: Content not rechecked, Cloud-file control, Privileged scan, Normal-user execution.
Archived formal excerpt · M3 · Fuller public model · record M3
M4 · Redirect the privileged write
Object Manager variation · Authored record
A distinct variation, not equivalent to an NTFS-junction patch in the related incident.
- P · Needs
- The attacker can run code as a normal user. The security engine is working on the attacker's path as SYSTEM. A normal user can create Object Manager symbolic links in their own namespace. The security engine does not re-check the path before it writes.
- M · Changes
- Change where the link points, after the security engine has checked the path and before it writes.
- Q · Leaves behind
- The security engine's SYSTEM-level write lands wherever the attacker chose.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ userscannerAttention = onAdversaryPathobjectSymlinkCreation ⊒ permittedToUserobjectPathRevalidation = absent
- M · Mechanism
rebind Object Manager symbolic links between the engine's path resolution and its use
- Q · Postconditions
privilegedWriteTarget = adversaryChosen
Presentation claim dependencies: Target path not rechecked, Privileged scan, Normal-user execution, Privileged write target.
Archived formal excerpt · M4 · Fuller public model · record M4
M5 · Reach SYSTEM execution
Requires both modeled inputs · Authored record
M3 and M4 provide two distinct required M5 inputs. This conjunction is retained from the canonical authored record; its necessity remains inferred and untested.
- P · Needs
- The attacker can run code as a normal user. The security engine is working on bytes the attacker chose. The security engine's write is going where the attacker chose.
- M · Changes
- Let the security engine finish the write using its own SYSTEM rights. Get the written file loaded and run.
- Q · Leaves behind
- The attacker is running code as SYSTEM.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ userprivilegedProcessInput = adversaryControlledprivilegedWriteTarget = adversaryChosen
- M · Mechanism
let the engine's remediation write complete under its own tokenhave the written image loaded in the privileged context
- Q · Postconditions
executionContext = SYSTEM
Presentation claim dependencies: Privileged write target, SYSTEM outcome, Content not rechecked, Target path not rechecked, Normal-user execution.
Archived formal excerpt · M5 · Fuller public model · record M5
M6 · Beyond escalation
Not modeled · Unmodeled stub
A visible boundary. The model does not invent lateral movement, credential access, or objectives after SYSTEM.
- P · Needs
- The attacker is running as SYSTEM.
- M · Changes
- Not covered here.
- Q · Leaves behind
- Not covered here.
Exact canonical formal P / M / Q
- P · Preconditions
executionContext ⊒ SYSTEM
- M · Mechanism
- Q · Postconditions
Presentation claim dependencies: SYSTEM outcome.
Fuller public model · record M6
No curated archived excerpt is supplied for this record; consult its full public model entry.
Archived excerpt provenance retains the original source classifications and selected exact ranges with hashes. The public model separates authored requirements from derived products; source-level corrections are documented in the correction manifest. The selected excerpt set is incomplete and is not fresh independent corroboration.