{ "export": { "name": "shieldbreak-mc", "version": "local-draft-3", "generated": "2026-10-07", "altitude": "type", "source_version": "0.4.0", "source_snapshot": "2026-09-05", "artifact_kind": "fuller corrected public model; local non-normative projection", "serialization": "JSON syntax compatible with YAML 1.2", "original_source_sha256": "24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70", "changes_file": "shieldbreak-model-changes.json" }, "bindings": { "spec": { "id": "MC-SPEC", "version": "0.4.19-draft", "sha256": "be8b75136580", "status": "WORKING DRAFT, VERIFIED", "authority": "every clause quoted in this corpus was taken from this bundle" }, "ontology": { "id": "mc-core", "version": "0.4.20.1", "spec_pin": "65b2c0f51cf7", "binding_status": "PROVISIONAL", "divergence": "The ontology pins MC-SPEC corpus 65b2c0f51cf7. The clause corpus used here is 0.4.19-draft, sha256 be8b75136580. The two do not agree, so every mc: term below is a proposed binding pending a re-pin. No clause text was taken from the ontology deposit." } }, "provenance": { "measured_elements": 0, "perturbation_runs": 0, "asserted_from": "sources", "rule": "Enablement edges, satisfaction verdicts, invariant cores, placement availability and profile terms are derived and MUST NOT be asserted (§2.3).", "original_default_kind": "derived", "authored_requirement_kind": "asserted", "derived_output_kind": "derived", "classification_scope": "Asserted labels on record clauses and steps describe authored source-based content. Ontology typing, dispositions, core estimates, graph edges and defensive profile terms retain their archival classifications; no reasoner, exploit, perturbation, detection or ratification test was run for this correction.", "correction_note": "The original blanket derived default conflated authored source-based requirements with derived products. This local source-level correction separates those categories without changing the inferred requirement basis or upgrading anything to measured." }, "state_variables": [ { "id": "cloudFilesFilter", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "contentRevalidation", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "defenderRealtime", "type": "mc:StateVariable", "origin": "mc:originDefender", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:HardeningAbsenceClause" ] }, { "id": "executionContext", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "hydrationCallbackOwner", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "imageMountByUser", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "junctionCreation", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "junctionPathRevalidation", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "localLogon", "type": "mc:StateVariable", "origin": "mc:originDefender", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:HardeningAbsenceClause" ] }, { "id": "objectPathRevalidation", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "objectSymlinkCreation", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "privilegedProcessInput", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "privilegedWriteTarget", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "scanRequestInterface", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] }, { "id": "scanTargetOwner", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "scannerAttention", "type": "mc:StateVariable", "origin": "mc:originNeither", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:ComposableClause" ] }, { "id": "syncRootRegistration", "type": "mc:StateVariable", "origin": "mc:originPlatform", "reachable_range": "undeclared", "clause_typings_observed": [ "mc:AmbientClause" ] } ], "records": [ { "id": "M0", "type": "mc:ManeuverRecord", "label": "Obtain unprivileged local execution", "label_plain": "Get a normal user account on the machine", "stub": true, "stub_rule": "§10.4 — unmodeled MUST NOT be reported as covered; the gap is the honest output", "rank": 0, "aligns_to_core": [], "precondition": [ { "clause": "localLogon ⊒ permitted", "clause_plain": "The attacker can log in locally, or already has a way to run code as a normal user.", "typing": "mc:HardeningAbsenceClause", "state_variable": "localLogon", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "— not authored", "step_plain": "Not covered here. No source says how this happens." } ], "postcondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "state_variable": "executionContext", "provenance_kind": "asserted" } ], "defensive_design_profile": null, "method_notes": [ "Authored as a stub. §10.4 makes silence the honest output where no record exists, and prefers the visible gap to a fill drawn from generic initial-access reporting.", "Its authored precondition is real content: the stub participates in the derived graph and carries nine inherited edges." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M1", "type": "mc:ManeuverRecord", "label": "Register an adversary-owned cloud-file sync root", "label_plain": "Set up a fake cloud-sync folder the attacker controls", "stub": false, "rank": 1, "aligns_to_core": [ "C0", "C1" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "cloudFilesFilter ⊒ present", "clause_plain": "The modeled operating system has the cloud-files driver, which is standard.", "typing": "mc:AmbientClause", "state_variable": "cloudFilesFilter", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" }, { "clause": "syncRootRegistration ⊒ permittedToUser", "clause_plain": "A normal user is allowed to register a cloud-sync folder.", "typing": "mc:AmbientClause", "state_variable": "syncRootRegistration", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "register a sync root and a placeholder file through the Cloud Filter API", "step_plain": "Register a sync folder and a placeholder file using the cloud-files API of the modeled operating system.", "provenance_kind": "asserted" }, { "step": "bind a hydration callback that runs in the adversary's own user-mode process", "step_plain": "Point the file's download handler at the attacker's own process.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "hydrationCallbackOwner = adversary", "clause_plain": "When anything opens that file, the attacker's process decides what it gets.", "state_variable": "hydrationCallbackOwner", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "deny unprivileged local code execution — application allowlisting, or removing the local logon right. The break is carried by executionContext; the two CFAPI clauses carry none" ], "items_plain": [ "Stop normal users running arbitrary programs. Application allowlisting does this. It works here because the attacker needs to run code first." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "an inventory rule on which processes hold a registered sync root, and on sync roots outside a known sync provider" ], "items_plain": [ "Inventory which processes have registered a cloud-sync folder. Flag any that are not your real sync client." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "revoke the local logon or the execution right — removes the clause this record reads" ], "items_plain": [ "Take away the local logon right or the ability to run code. That removes the condition this step needs." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "No defender-reachable value stops an unprivileged process registering a sync root and binding its own hydration callback." ], "items_plain": [ "Nothing you can configure stops a normal user from doing this. The modeled operating system allows it by design. If your build has a control we did not find, tell us and this cell changes." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "the registration itself: a placeholder tree created by a process that is not a known sync provider" ], "items_plain": [ "Watch for a placeholder file tree created by a process that is not a known sync client." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "registration completes in one call; no ongoing operation remains to act on" ], "items_plain": [ "The registration is one API call and it is over. There is nothing still running to stop." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "hydrationCallbackOwner is established by the platform's own registration path" ], "items_plain": [ "The modeled operating system sets this up itself as part of registration. There is no setting that blocks it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a placeholder whose provider process is short-lived, unsigned, or not a registered sync client" ], "items_plain": [ "Watch for placeholder files whose owning process is unsigned or short-lived." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "terminate the owning process and unregister the sync root — evicts the postcondition M2 and M3 read" ], "items_plain": [ "Kill the process and unregister the sync folder. That removes what the next two steps need." ], "provenance_kind": "derived" } ], "variation_against_core": "none", "method_notes": [ "Both CFAPI clauses are typed platform-origin under §3.1.1 rather than hardening-absence, because no source names a defensive control that reaches them. §4.6.4 then forbids the prevent-at-mechanism cell reporting as defended.", "Authored as a record rather than folded into M2's mechanism because it yields hydrationCallbackOwner, which M2 and M3 both require. §4.5.1 declines to promote a mechanism-slot filler to a maneuver; this is not one." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M2", "type": "mc:ManeuverRecord", "label": "Induce a privileged scan of the adversary's path", "label_plain": "Get the security engine to scan the attacker's folder", "stub": false, "rank": 2, "aligns_to_core": [ "C0" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "hydrationCallbackOwner = adversary", "clause_plain": "The attacker's process controls what that file returns when read.", "typing": "mc:ComposableClause", "state_variable": "hydrationCallbackOwner", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "defenderRealtime ⊒ enabled", "clause_plain": "The security engine is running.", "typing": "mc:HardeningAbsenceClause", "state_variable": "defenderRealtime", "provenance_kind": "asserted" }, { "clause": "scanRequestInterface ⊒ callableByUser", "clause_plain": "A normal user can ask the security engine to scan something.", "typing": "mc:AmbientClause", "state_variable": "scanRequestInterface", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "call the Defender client interface to open the manager and start a resource scan against the prepared path", "step_plain": "Ask the security engine to scan the folder, using the same interface any user program can call.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "scannerAttention = onAdversaryPath", "clause_plain": "The security engine is now reading a path the attacker set up, and it is running as SYSTEM.", "state_variable": "scannerAttention", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Deny unprivileged local code execution.", "Turning Defender off also breaks this record, and it costs the estate its protection." ], "items_plain": [ "Stop normal users running arbitrary programs.", "Turn the security engine off. This works and you should not do it, because it removes your protection along with the attack." ], "ext_selfDefeatingReach": true, "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a rule pairing a fresh sync-root registration with a scan request from the same unprivileged process" ], "items_plain": [ "Alert when the same normal user process registers a sync folder and then asks the security engine to scan it." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "unregister the sync root before the scan is requested — revokes hydrationCallbackOwner" ], "items_plain": [ "Unregister the sync folder before the scan starts." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "the Defender client interface is callable by an unprivileged process by design. No defender-reachable value blocks a user-requested resource scan" ], "items_plain": [ "Any user program can ask the security engine to scan a file. That is how the product works and there is no setting to change it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "an unprivileged process opening the Defender manager interface and starting a resource scan against a path it created moments earlier" ], "items_plain": [ "Alert on a normal user process opening the security engine's management interface and scanning a folder it just created." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the scan request returns before any response resolves against it" ], "items_plain": [ "The scan request finishes immediately. There is nothing to intercept." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "scannerAttention is established by the engine acting on its own request queue" ], "items_plain": [ "The security engine decides what to scan off its own queue. You cannot block this from outside." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "engine scan-start telemetry naming a placeholder path under a user-writable sync root" ], "items_plain": [ "Look for the security engine scan-start events naming a placeholder file in a user-writable folder." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "abort the scan and evict the placeholder — removes the postcondition M3 and M4 both read" ], "items_plain": [ "Cancel the scan and delete the placeholder. That removes what the next two steps need." ], "provenance_kind": "derived" } ], "variation_against_core": "none", "method_notes": [ "defenderRealtime ⊒ enabled is defender-settable and its defeating value lies inside the reachable range under §3.1.2, so §4.6.4 would let an unsatisfied clause report defended. §10.5.1's reach term asks whether a defeating value is reachable and not what reaching it costs.", "The corpus-local self-defeating marker annotates a state; it is not a fifth state." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M3", "type": "mc:ManeuverRecord", "label": "Vary the served bytes between the detection read and the remediation read", "label_plain": "Swap the file contents while the security engine is cleaning it up", "stub": false, "rank": 3, "aligns_to_core": [ "C0", "C1", "C2" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "hydrationCallbackOwner = adversary", "clause_plain": "The attacker's process decides what the security engine reads from that file.", "typing": "mc:ComposableClause", "state_variable": "hydrationCallbackOwner", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "scannerAttention = onAdversaryPath", "clause_plain": "The security engine is scanning the attacker's path as SYSTEM.", "typing": "mc:ComposableClause", "state_variable": "scannerAttention", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "contentRevalidation = absent", "clause_plain": "The security engine does not re-check the contents before acting on them.", "typing": "mc:AmbientClause", "state_variable": "contentRevalidation", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "serve detected test content on the first hydration, so the engine enters remediation", "step_plain": "Hand the security engine a file it will flag, so it starts cleaning it up.", "provenance_kind": "asserted" }, { "step": "serve different content on the restart hydration that the remediation read triggers", "step_plain": "Hand it different contents when it reads the file again during cleanup.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "privilegedProcessInput = adversaryControlled", "clause_plain": "The security engine is now working on bytes the attacker chose, with SYSTEM rights.", "state_variable": "privilegedProcessInput", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "carried by executionContext alone. contentRevalidation = absent carries none, because that clause is platform-origin and it is the vulnerability" ], "items_plain": [ "Stop normal users running arbitrary programs. That is the only condition here you can act on." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "the M2 pairing plus a detected-threat event on a placeholder path — the first point in the chain that emits a first-party Defender event" ], "items_plain": [ "Look for a threat detection by the security engine on a placeholder file in a user-writable sync folder. This is the first event from the security engine in the chain." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "unregister the sync root mid-chain — removes hydrationCallbackOwner before the second read" ], "items_plain": [ "Unregister the sync folder before the cleanup read happens." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "Only an engine change makes the remediation read revalidate what the detection read validated. Microsoft has published no update and no affected-build list for CVE-2026-69414 as of 2026-09-05.[15]" ], "items_plain": [ "Nothing you can configure fixes this. Only the engine vendor can make the cleanup step re-check what it reads, and there is no patch as of 5 September 2026." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "A detected-threat event on a placeholder path, followed by a restart hydration serving different bytes. This is the strongest signal in the corpus and it survives a change of payload." ], "items_plain": [ "Look for a threat detection on a placeholder file, followed by a second read that returns different data. This is the best signal available, and it stays useful even if the attacker changes the payload." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the substitution completes inside the engine's own remediation path" ], "items_plain": [ "The swap happens inside the security engine's own cleanup routine. There is no window to act in." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "privilegedProcessInput is established inside the engine's address space" ], "items_plain": [ "This happens inside the security engine's memory. Nothing outside it can stop it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "remediation and quarantine events whose written content does not match the content that was detected" ], "items_plain": [ "Compare what the security engine detected against what it wrote during cleanup. A mismatch is the tell." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "roll back the quarantine action and delete the written object — evicts the postcondition M5 reads" ], "items_plain": [ "Undo the quarantine action and delete what got written." ], "provenance_kind": "derived" } ], "variation_against_core": { "core": "C2", "tier": "mc:VariationTier", "still_required_by_record": true, "elements": [ { "element": "contentRevalidation = absent", "element_plain": "The security engine does not re-check the file contents before acting on them." }, { "element": "vary the bytes served across two hydrations", "element_plain": "Serving different bytes on the second read." } ] }, "method_notes": [ "The three composable clauses carry the leverage; contentRevalidation = absent is platform-origin under §3.1.1, which reserves that origin for what the vendor, version or configuration fixes.", "§10.5.3 requires no placement available and available and not deployed to stay separable, because collapsing them “tells a defender either to buy a control that cannot exist, or that nothing can be done where something can.” That is why the prevent-at-mechanism cell reads unreachable-by-defender rather than undefended." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M4", "type": "mc:ManeuverRecord", "label": "Rebind the Object Manager path the privileged write resolves", "label_plain": "Redirect where the security engine's privileged write lands", "stub": false, "rank": 3, "aligns_to_core": [ "C0", "C1", "C2" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "scannerAttention = onAdversaryPath", "clause_plain": "The security engine is working on the attacker's path as SYSTEM.", "typing": "mc:ComposableClause", "state_variable": "scannerAttention", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "objectSymlinkCreation ⊒ permittedToUser", "clause_plain": "A normal user can create Object Manager symbolic links in their own namespace.", "typing": "mc:AmbientClause", "state_variable": "objectSymlinkCreation", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" }, { "clause": "objectPathRevalidation = absent", "clause_plain": "The security engine does not re-check the path before it writes.", "typing": "mc:AmbientClause", "state_variable": "objectPathRevalidation", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "rebind Object Manager symbolic links between the engine's path resolution and its use", "step_plain": "Change where the link points, after the security engine has checked the path and before it writes.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "privilegedWriteTarget = adversaryChosen", "clause_plain": "The security engine's SYSTEM-level write lands wherever the attacker chose.", "state_variable": "privilegedWriteTarget", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "the executionContext clause; the two platform clauses carry no break" ], "items_plain": [ "Stop normal users running arbitrary programs." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "Object Manager symbolic-link creation by an unprivileged process against a path already under scan" ], "items_plain": [ "Alert on a normal user creating symbolic links against a path the security engine is currently scanning." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "unregister the sync root — removes the supplier of scannerAttention" ], "items_plain": [ "Unregister the sync folder, which removes what this step reads." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "No source names a control that blocks an unprivileged process rebinding an Object Manager symbolic link in its own namespace. A deployment that can name one moves this cell to a break." ], "items_plain": [ "We could not find a setting that stops a normal user rebinding these links in their own namespace. If your build has one, this cell changes." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a symbolic-link rebind occurring between a scan start and a remediation write on the same path" ], "items_plain": [ "Look for a link being repointed between a scan starting and a cleanup write finishing on the same path." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the rebind is a single object operation and is over before a response resolves" ], "items_plain": [ "Repointing a link is a single operation. It is done before anything can react." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "the write target is resolved inside the engine" ], "items_plain": [ "The security engine resolves the write target internally." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a privileged write from the engine process landing outside its own quarantine store" ], "items_plain": [ "Alert when the security engine writes to somewhere outside its own quarantine folder." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "delete or restore the written target — evicts privilegedWriteTarget" ], "items_plain": [ "Delete or restore whatever got written." ], "provenance_kind": "derived" } ], "variation_against_core": { "core": "C2", "tier": "mc:VariationTier", "still_required_by_record": true, "elements": [ { "element": "objectPathRevalidation = absent", "element_plain": "The security engine does not re-check the Object Manager path before it writes." }, { "element": "rebind an Object Manager symbolic link", "element_plain": "Repointing an Object Manager link." } ] }, "method_notes": [ "M3, M4 and N3 align to core C2 and differ only in their variations. §4.7.1 transfers a defensive result across a core only where the placement acts on the invariant, so an engine fix aimed at one variation buys that member and transfers to neither sibling.", "objectPathRevalidation and junctionPathRevalidation are two state variables. Modelled as one, the corpus would report the July fix as closing the class." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M5", "type": "mc:ManeuverRecord", "label": "Convert the privileged remediation write into SYSTEM execution", "label_plain": "Turn the redirected write into SYSTEM-level code execution", "stub": false, "rank": 4, "aligns_to_core": [ "C0", "C3" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "privilegedProcessInput = adversaryControlled", "clause_plain": "The security engine is working on bytes the attacker chose.", "typing": "mc:ComposableClause", "state_variable": "privilegedProcessInput", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "privilegedWriteTarget = adversaryChosen", "clause_plain": "The security engine's write is going where the attacker chose.", "typing": "mc:ComposableClause", "state_variable": "privilegedWriteTarget", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "let the engine's remediation write complete under its own token", "step_plain": "Let the security engine finish the write using its own SYSTEM rights.", "provenance_kind": "asserted" }, { "step": "have the written image loaded in the privileged context", "step_plain": "Get the written file loaded and run.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "executionContext = SYSTEM", "clause_plain": "The attacker is running code as SYSTEM.", "state_variable": "executionContext", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Deny unprivileged local code execution, which invalidates the executionContext clause.", "Break any supplier: M3, M4 or N3. Each yields a clause this record requires." ], "items_plain": [ "Stop normal users running arbitrary programs.", "Break any of the earlier steps that feed this one." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "the conjunction itself: a content substitution and a path rebind against one scanned path in one scan window" ], "items_plain": [ "Look for both things happening to one path in one scan: a content swap and a path redirect." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "evict any supplier's postcondition before the write completes" ], "items_plain": [ "Undo any earlier step before the write finishes." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "the write executes under the engine's own token. No defender-reachable value blocks it short of disabling the engine" ], "items_plain": [ "The security engine does the write itself using its own account. Nothing short of turning the security engine off stops it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a privileged write from the engine process to a path outside its own store" ], "items_plain": [ "Alert when the security engine writes to a path outside its own folders." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the write and the load complete inside the privileged process" ], "items_plain": [ "The write and the load both happen inside the security engine. There is no window." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "no defender-reachable value stops SYSTEM context being established once the suppliers hold" ], "items_plain": [ "Once the earlier steps hold, SYSTEM access follows. Nothing outside the security engine stops it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "An unexpected child process or module load from the engine process. This is the signal the published guidance names.[2][14]" ], "items_plain": [ "Alert on unexpected child processes or module loads coming from the security engine. This is the signal the public guidance points at." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Terminate the SYSTEM-context process and rebuild the host. This is the only response in the corpus that also covers the other incident's terminal step." ], "items_plain": [ "Kill the SYSTEM process and rebuild the host. This is the one response in the corpus that also covers the equivalent step in the older bug." ], "provenance_kind": "derived" } ], "variation_against_core": { "core": "C3", "tier": "mc:VariationTier", "still_required_by_record": true, "elements": [ { "element": "privilegedProcessInput = adversaryControlled", "element_plain": "The security engine has to be working on bytes the attacker chose, as well as writing where the attacker chose." } ] }, "method_notes": [ "privilegedProcessInput remains in this record's required set. §11.4 permits asserting only what is forced, and no ShieldBreak source separates the two contributions.", "privilegedProcessInput is M5's variation against C3 rather than part of the core, following §4.4.4.4 on a record that reduces the estimate. §4.4.4.1 places a record's required difference in the variation and §4.4.3 keeps it out of the core's identity, so the class claims less while this record claims the same.", "The demotion has a floor. A variation is still required (§4.4.4.1). If a bench run showed the clause is not required at all, it would tier as incidental under §4.4.3.2, M5's required set would equal N4's, and §4.4.2 would make them one maneuver rather than two — which would in turn take C3 to a population of one and force its withdrawal under §4.4.5.3. That consequence is not claimed here. It is the reason the bench run is still worth doing." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "N1", "type": "mc:ManeuverRecord", "label": "Mount an adversary-supplied volume holding the scan target", "label_plain": "Mount a disc image the attacker made", "stub": false, "rank": 1, "aligns_to_core": [ "C0" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "imageMountByUser ⊒ permittedToUser", "clause_plain": "A normal user is allowed to mount a disc image.", "typing": "mc:AmbientClause", "state_variable": "imageMountByUser", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "mount a disc image the user supplies, placing attacker-written files on a path the engine will read", "step_plain": "Mount an ISO the attacker built, so their files sit on a path the security engine will read.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "scanTargetOwner = adversary", "clause_plain": "The attacker owns the files the security engine is about to look at.", "state_variable": "scanTargetOwner", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "the executionContext clause" ], "items_plain": [ "Stop normal users running arbitrary programs." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "Image mounts performed by unprivileged users, named as an indicator in the published guidance.[10]" ], "items_plain": [ "Watch for normal users mounting disc images. The public RoguePlanet guidance calls this out." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "revoke the local logon or the execution right" ], "items_plain": [ "Take away the local logon right." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "On Windows Server an unprivileged user cannot mount an image, so the record fails there by platform default.[11] That is the operating system, not a control anyone deployed. On client editions no source names a control that blocks mounting." ], "items_plain": [ "On the server edition of the modeled platform, normal users cannot mount disc images at all, so this step already fails there. That is the platform doing it, not a control you put in place, and it is worth knowing the difference. On the modeled client editions we could not find a supported setting that blocks it." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "mount events for images written by the mounting user" ], "items_plain": [ "Alert on mount events for images the mounting user wrote." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Dismount the volume before the scan resolves. A response reaches this record where a prevention does not." ], "items_plain": [ "Dismount the volume before the scan finishes. You can respond here even though you cannot prevent." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "scanTargetOwner is established by the mount itself" ], "items_plain": [ "The mount itself puts the attacker's files in place. There is nothing to block afterwards." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a newly mounted volume containing files that trigger a detection within seconds" ], "items_plain": [ "Watch for a freshly mounted volume that triggers a detection within seconds." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "dismount and delete the image" ], "items_plain": [ "Dismount and delete the image." ], "provenance_kind": "derived" } ], "variation_against_core": "none", "method_notes": [ "The Server outcome is not a defensive result. §4.6.4 reports a clause defeated outside the defender's reach as unreachable-by-defender, and §4.6.5 reads it as ambient for attribution, so no server posture earns credit for it.", "Authoring this record enlarged the population supporting C2." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "N2", "type": "mc:ManeuverRecord", "label": "Induce a privileged scan of the mounted volume", "label_plain": "Get the security engine to scan the mounted volume", "stub": false, "rank": 2, "aligns_to_core": [ "C0" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "scanTargetOwner = adversary", "clause_plain": "The attacker owns the files on the mounted volume.", "typing": "mc:ComposableClause", "state_variable": "scanTargetOwner", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "defenderRealtime ⊒ enabled", "clause_plain": "The security engine is running.", "typing": "mc:HardeningAbsenceClause", "state_variable": "defenderRealtime", "provenance_kind": "asserted" }, { "clause": "scanRequestInterface ⊒ callableByUser", "clause_plain": "A normal user can get the security engine to look at a file.", "typing": "mc:AmbientClause", "state_variable": "scanRequestInterface", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "place content the engine will flag on the mounted volume, so real-time protection opens a remediation on it", "step_plain": "Put something on the volume that the security engine will flag, so it starts cleaning it up.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "scannerAttention = onAdversaryPath", "clause_plain": "The security engine is working on the attacker's path as SYSTEM.", "state_variable": "scannerAttention", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Deny unprivileged local code execution.", "Turning Defender off also breaks this record, at the same cost as in M2." ], "items_plain": [ "Stop normal users running arbitrary programs.", "Turning the security engine off also works here, at the same cost as in the ShieldBreak chain." ], "ext_selfDefeatingReach": true, "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a detection firing on a volume the same unprivileged user mounted seconds earlier" ], "items_plain": [ "Alert when a detection fires on a volume the same user mounted seconds before." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "dismount the volume before the engine resolves" ], "items_plain": [ "Dismount the volume before the security engine finishes." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "real-time protection opens on flagged content by design; no defender-reachable value suppresses that without suppressing protection" ], "items_plain": [ "Real-time protection acts on flagged files. Suppressing that means suppressing protection." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "detection events whose path sits on a user-mounted volume" ], "items_plain": [ "Look for detections whose file path is on a user-mounted volume." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the detection resolves faster than a response placed outside the engine" ], "items_plain": [ "The security engine reacts faster than anything you can place outside it." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "scannerAttention is established by the engine's own queue" ], "items_plain": [ "The security engine works off its own queue." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "scan and remediation start events on user-mounted volumes" ], "items_plain": [ "Watch scan and cleanup start events on user-mounted volumes." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "abort the remediation and dismount" ], "items_plain": [ "Cancel the cleanup and dismount." ], "provenance_kind": "derived" } ], "variation_against_core": "none", "method_notes": [ "Structurally the same maneuver as M2 with a different supplier upstream, which is why both align to C0 and neither aligns to C1: requesting a scan does not own a resolution the engine performs, it starts one.", "The self-defeating marker recurs here. That recurrence is the argument for referring it to the spec rather than keeping it corpus-local, since it arises for any record requiring a security control to be running." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "N3", "type": "mc:ManeuverRecord", "label": "Win the race and swap the junction between the check and the privileged use", "label_plain": "Swap the folder link at the exact moment the security engine is using it", "stub": false, "rank": 3, "aligns_to_core": [ "C0", "C1", "C2" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "scannerAttention = onAdversaryPath", "clause_plain": "The security engine is working on the attacker's path as SYSTEM.", "typing": "mc:ComposableClause", "state_variable": "scannerAttention", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "junctionCreation ⊒ permittedToUser", "clause_plain": "A normal user can create NTFS junctions.", "typing": "mc:AmbientClause", "state_variable": "junctionCreation", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" }, { "clause": "junctionPathRevalidation = absent", "clause_plain": "The security engine does not re-check the path between checking it and writing to it.", "typing": "mc:AmbientClause", "state_variable": "junctionPathRevalidation", "disposition_if_unsatisfied": "mc:dispUnreachableByDefender", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "rebind an NTFS junction between the engine's path check and its quarantine write, repeating until the race is won", "step_plain": "Repoint the junction in the gap between the security engine's check and its write. Retry until the timing lands.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "privilegedWriteTarget = adversaryChosen", "clause_plain": "The security engine's SYSTEM-level write lands wherever the attacker chose.", "state_variable": "privilegedWriteTarget", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "the executionContext clause" ], "items_plain": [ "Stop normal users running arbitrary programs." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "junction or reparse-point creation by an unprivileged process near a path under scan" ], "items_plain": [ "Alert on junction or reparse-point creation near a path the security engine is scanning." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "dismount the volume, removing the supplier of scannerAttention" ], "items_plain": [ "Dismount the volume." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Malware Protection Engine 1.1.26060.3008 moved this clause from absent to present in July 2026, so patching reaches it.[11][12] The sibling clauses on M3 and M4 have no such fix." ], "items_plain": [ "This is the only step in the corpus you can fix by patching. The security engine 1.1.26060.3008, from July 2026, closed it. The same gap in the two ShieldBreak steps is still open." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "repeated reparse-point rebinds against one path inside a single remediation window, which is the race being retried" ], "items_plain": [ "Look for the same path having its link repointed over and over inside one cleanup window. That is the race being retried." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the successful attempt completes in milliseconds" ], "items_plain": [ "The attempt that works finishes in milliseconds." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "the write target is resolved inside the engine" ], "items_plain": [ "The security engine resolves the target internally." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a privileged write from the engine landing outside its quarantine store" ], "items_plain": [ "Alert when the security engine writes outside its own folders." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "delete or restore the written target" ], "items_plain": [ "Delete or restore what got written." ], "provenance_kind": "derived" } ], "variation_against_core": { "core": "C2", "tier": "mc:VariationTier", "still_required_by_record": true, "elements": [ { "element": "junctionPathRevalidation = absent", "element_plain": "The security engine does not re-check the junction path before it writes." }, { "element": "rebind an NTFS junction, retried", "element_plain": "Repointing an NTFS junction, retried until the timing lands." } ] }, "method_notes": [ "N3 aligns to C2 on its structure alone, taking that core's support from two to three and clearing §4.4.4's floor. C2 was estimated before N3 existed, which demonstrates §4.4.5.1's claim that membership is a test any record can be put through rather than a roster.", "Authoring it forced the pathRevalidation split described in M4's method note." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "N4", "type": "mc:ManeuverRecord", "label": "Convert the redirected quarantine write into SYSTEM execution", "label_plain": "Turn the redirected write into SYSTEM-level code execution", "stub": false, "rank": 4, "aligns_to_core": [ "C0", "C3" ], "precondition": [ { "clause": "executionContext ⊒ user", "clause_plain": "The attacker can run code as a normal user.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" }, { "clause": "privilegedWriteTarget = adversaryChosen", "clause_plain": "The security engine's write is going where the attacker chose.", "typing": "mc:ComposableClause", "state_variable": "privilegedWriteTarget", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "let the quarantine write land at the chosen target under the engine's token, and have it executed", "step_plain": "Let the security engine finish the write with its own rights, then get the result executed.", "provenance_kind": "asserted" } ], "postcondition": [ { "clause": "executionContext = SYSTEM", "clause_plain": "The attacker is running code as SYSTEM.", "state_variable": "executionContext", "provenance_kind": "asserted" } ], "defensive_design_profile": [ { "cell": "mc:cellPreventAtPrecondition", "function": "mc:prevent", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Deny unprivileged local code execution.", "Break the single supplier N3, which patching reaches." ], "items_plain": [ "Stop normal users running arbitrary programs.", "Patch the one step that feeds this." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPrecondition", "function": "mc:detect", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "one redirected privileged write is the whole precondition here, which is what makes this record's detection burden lighter than M5's" ], "items_plain": [ "This step only needs one thing to be true, so there is less to correlate than in the ShieldBreak version." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPrecondition", "function": "mc:respond", "locus": "mc:preconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "evict privilegedWriteTarget before the write completes" ], "items_plain": [ "Undo the redirect before the write finishes." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtMechanism", "function": "mc:prevent", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "the write executes under the engine's own token" ], "items_plain": [ "The security engine does the write with its own account." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtMechanism", "function": "mc:detect", "locus": "mc:mechanismLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "a privileged write from the engine process to a path outside its own store" ], "items_plain": [ "Alert when the security engine writes outside its own folders." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtMechanism", "function": "mc:respond", "locus": "mc:mechanismLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "no required element at this locus to act on", "items": [ "the write and the execution complete inside the privileged context" ], "items_plain": [ "The write and the execution both happen inside the security engine." ], "provenance_kind": "derived" }, { "cell": "mc:cellPreventAtPostcondition", "function": "mc:prevent", "locus": "mc:postconditionLocus", "placement_availability": "mc:stateNoPlacementAvailable", "breaks_maneuver": false, "semantics": "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended", "items": [ "no defender-reachable value stops SYSTEM context being established once the supplier holds" ], "items_plain": [ "Once the redirect holds, SYSTEM access follows." ], "provenance_kind": "derived" }, { "cell": "mc:cellDetectAtPostcondition", "function": "mc:detect", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": false, "semantics": "a detect placement; structurally breaks nothing at any locus", "items": [ "A SYSTEM shell or child process appearing from the engine. Public reporting put the full chain at roughly five seconds.[13]" ], "items_plain": [ "Watch for a SYSTEM shell appearing from the security engine. Public reporting put the whole chain at around five seconds." ], "provenance_kind": "derived" }, { "cell": "mc:cellRespondAtPostcondition", "function": "mc:respond", "locus": "mc:postconditionLocus", "placement_availability": "mc:statePlacementUnplaced", "breaks_maneuver": true, "semantics": "a placement here structurally breaks the record and the defeating value is defender-reachable", "items": [ "Terminate and rebuild. The same response covers M5." ], "items_plain": [ "Kill it and rebuild the host. This response also covers the ShieldBreak equivalent." ], "provenance_kind": "derived" } ], "variation_against_core": "none", "method_notes": [ "This record requires strictly less than M5 and reaches the same postcondition, which is what placed privilegedProcessInput in M5's variation against core C3 rather than in the core.", "§4.4.4.4 governs the disposition: the record is evidence about the behavior and must not be excluded to protect the estimate it corrects. N4 has no variation against C3; its required set is the core." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" }, { "id": "M6", "type": "mc:ManeuverRecord", "label": "Post-escalation continuation", "label_plain": "Whatever the attacker does with SYSTEM next", "stub": true, "stub_rule": "§10.4 — unmodeled MUST NOT be reported as covered; the gap is the honest output", "rank": 5, "aligns_to_core": [], "precondition": [ { "clause": "executionContext ⊒ SYSTEM", "clause_plain": "The attacker is running as SYSTEM.", "typing": "mc:ComposableClause", "state_variable": "executionContext", "disposition_if_unsatisfied": "mc:dispPreconditionUnmet", "provenance_kind": "asserted" } ], "mechanism": [ { "step": "— not authored", "step_plain": "Not covered here." } ], "postcondition": [ { "clause": "— not authored", "clause_plain": "Not covered here." } ], "defensive_design_profile": null, "method_notes": [ "Authored as a stub so both chains terminate visibly rather than implying that SYSTEM is the objective. §10.4 makes silence the honest output where no record exists.", "Its authored precondition grounds C3's required effect. §4.4.5.2 grounds a required effect against the continuations it enables, and this stub reads executionContext = SYSTEM, which is why C3 is the one core here with a non-empty Q* and the one whose respond placement transfers (§4.4.4.3)." ], "requirement_provenance": "asserted", "requirement_basis": "inferred from historical sources; no perturbation" } ], "invariant_cores": [ { "id": "C0", "type": "mc:InvariantCore", "provenance": "derived", "identity_status": "provisional", "core_requires_state": [ "executionContext ⊒ user" ], "invariant_composes": [], "core_requires_effect": [], "core_support": 9, "members_observed": [ "M1", "M2", "M3", "M4", "M5", "N1", "N2", "N3", "N4" ], "membership_rule": "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition", "below_support_floor": false, "floor_handling": "record_do_not_block", "respond_transfer": "none" }, { "id": "C1", "type": "mc:InvariantCore", "provenance": "derived", "identity_status": "provisional", "core_requires_state": [ "executionContext ⊒ user" ], "invariant_composes": [ "own a resolution the privileged component performs on its own behalf" ], "core_requires_effect": [], "core_support": 4, "members_observed": [ "M1", "M3", "M4", "N3" ], "membership_rule": "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition", "core_subsumed_by": "C0", "below_support_floor": false, "floor_handling": "record_do_not_block", "respond_transfer": "none" }, { "id": "C2", "type": "mc:InvariantCore", "provenance": "derived", "identity_status": "provisional", "core_requires_state": [ "executionContext ⊒ user", "scannerAttention = onAdversaryPath" ], "invariant_composes": [ "alter the resolved value between the check and the use" ], "core_requires_effect": [], "core_support": 3, "members_observed": [ "M3", "M4", "N3" ], "membership_rule": "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition", "core_subsumed_by": "C1", "below_support_floor": false, "floor_handling": "record_do_not_block", "respond_transfer": "none" }, { "id": "C3", "type": "mc:InvariantCore", "provenance": "derived", "identity_status": "provisional", "core_requires_state": [ "executionContext ⊒ user", "privilegedWriteTarget = adversaryChosen" ], "invariant_composes": [ "let the privileged write land at the chosen target and be executed" ], "core_requires_effect": [ "executionContext = SYSTEM" ], "core_support": 2, "members_observed": [ "M5", "N4" ], "membership_rule": "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition", "core_subsumed_by": "C0", "below_support_floor": true, "floor_handling": "record_do_not_block", "respond_transfer": "class_wide" } ], "enablement_graph": { "relation": "mc:canUnlock", "provenance": "derived", "recompute_rule": "§6.2 — MUST recompute when any triple or value order changes; edges MUST NOT be asserted", "edge_semantics": "§6.2 — an edge says the earlier postcondition establishes at least one clause the later precondition requires; not all of them, and not that the later maneuver becomes available", "reachability_claim": "forbidden", "edges": [ { "from": "M0", "to": "M1", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "M2", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "M3", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "M4", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "M5", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "N1", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "N2", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "N3", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M0", "to": "N4", "carries": "executionContext", "from_stub": true, "disjunct_supplier": false }, { "from": "M1", "to": "M2", "carries": "hydrationCallbackOwner", "from_stub": false, "disjunct_supplier": false }, { "from": "M1", "to": "M3", "carries": "hydrationCallbackOwner", "from_stub": false, "disjunct_supplier": false }, { "from": "M2", "to": "M3", "carries": "scannerAttention", "from_stub": false, "disjunct_supplier": false }, { "from": "M2", "to": "M4", "carries": "scannerAttention", "from_stub": false, "disjunct_supplier": false }, { "from": "N1", "to": "N2", "carries": "scanTargetOwner", "from_stub": false, "disjunct_supplier": false }, { "from": "N2", "to": "N3", "carries": "scannerAttention", "from_stub": false, "disjunct_supplier": false }, { "from": "M3", "to": "M5", "carries": "privilegedProcessInput", "from_stub": false, "disjunct_supplier": false }, { "from": "M4", "to": "M5", "carries": "privilegedWriteTarget", "from_stub": false, "disjunct_supplier": true }, { "from": "N3", "to": "M5", "carries": "privilegedWriteTarget", "from_stub": false, "disjunct_supplier": true }, { "from": "M4", "to": "N4", "carries": "privilegedWriteTarget", "from_stub": false, "disjunct_supplier": true }, { "from": "N3", "to": "N4", "carries": "privilegedWriteTarget", "from_stub": false, "disjunct_supplier": true }, { "from": "M5", "to": "M6", "carries": "executionContext", "from_stub": false, "disjunct_supplier": false }, { "from": "N4", "to": "M6", "carries": "executionContext", "from_stub": false, "disjunct_supplier": false } ] }, "completeness_claim": { "scope_named": true, "closed_over": [ "CVE-2026-69414 as reported", "CVE-2026-50656 as reported", "references 1-17" ], "not_closed_over": [ "either exploit binary", "engine internals", "Windows 10 variance", "post-escalation stages" ], "unasserted_within_scope_evaluates": "absent", "unasserted_outside_scope_evaluates": "unmodeled", "declared_silence_carried": [ "§6.3 — frame conditions and parallel-chain interference are unspecified in the bound draft" ], "draft_caveat": "§1.5 — the conceptual ratification suite has not been run against the bound text", "exclusions_for_ambient_clause": 0 }, "extensions": { "declared_under": "§14.2 — a domain extension declares its scope and its added terms", "self_defeating_reach": { "status": "corpus_local_not_spec", "definition": "Annotates a grid cell whose defeating value lies inside the defender reachable range under §3.1.2 and whose reach removes the control being defended. It annotates an existing placement-availability state and does not add a fifth one.", "gap_addressed": "§10.5.1 reach asks whether a defeating value is reachable and not what reaching it costs" }, "support_floor_as_record": { "status": "corpus_local_not_spec", "definition": "a core below the §4.4.4 floor is named and flagged; the floor is reported, never a bar on naming" }, "render_pair": { "status": "corpus_local_not_spec", "definition": "Every reporting string carries a formal render and a plain render of the same modeled fact. §12.1 forbids a projection introducing new reasoning, so the two renders MUST agree on every modeled value; only vocabulary differs." }, "method_note_separation": { "status": "corpus_local_not_spec", "definition": "framework commentary is a typed block, addressed to MC researchers, removable without touching any derived fact" } }, "open_items": [], "references": [ { "id": 1, "citation": "Sheel, Vamika. \"CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days.\" Qualys Blog, 25 August 2026, updated 3 September 2026.", "url": "https://blog.qualys.com/product-tech/2026/08/24/shieldbreak-the-windows-defender-zero-day-with-no-patch-detect-it-mitigate-it-with-qualys", "retrieval": "full text retrieved 2026-09-05" }, { "id": 2, "citation": "\"ShieldBreak: A Local Privilege Escalation Path Through Microsoft Defender.\" CyberMaxx, August 2026.", "url": "https://www.cybermaxx.com/resources/shieldbreak-a-local-privilege-escalation-path-through-microsoft-defender/", "retrieval": "search excerpt only" }, { "id": 3, "citation": "\"Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak).\" Arctic Wolf, August 2026.", "url": "https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/", "retrieval": "search excerpt only" }, { "id": 4, "citation": "\"ShieldBreak bypasses Microsoft's patch for earlier Defender flaw.\" Malwarebytes Labs, August 2026.", "url": "https://www.malwarebytes.com/blog/bugs/2026/08/shieldbreak-bypasses-microsofts-patch-for-earlier-defender-flaw", "retrieval": "search excerpt only" }, { "id": 5, "citation": "\"New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges.\" BleepingComputer, August 2026.", "url": "https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/", "retrieval": "search excerpt only" }, { "id": 6, "citation": "\"Microsoft working on Defender patch for ShieldBreak zero-day.\" BleepingComputer, August 2026. Carries Will Dormann's confirmation that the exploit works and that Defender must be enabled.", "url": "https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/", "retrieval": "search excerpt only" }, { "id": 7, "citation": "\"ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access.\" The Hacker News, 13 August 2026 (updated after publication).", "url": "https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html", "retrieval": "search excerpt only" }, { "id": 8, "citation": "MSNightmare. \"ShieldBreak: Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced.", "url": "https://github.com/MSNightmare/ShieldBreak", "retrieval": "repository description only", "original_citation": "MSNightmare. \"ShieldBreak \" Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced.", "display_correction": "Punctuation normalized for display from the archived title; original wording has not been independently checked." }, { "id": 9, "citation": "\"CVE-2026-69414 Defender Flaw Has No Fix or Affected Builds.\" Windows Forum, 3 September 2026.", "url": "https://windowsforum.com/windows-news.4/cve-2026-69414-defender-flaw-has-no-fix-or-affected-builds.443144/", "retrieval": "search excerpt only" }, { "id": 10, "citation": "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 and 11 Systems.\" Rescana, 18 June 2026.", "url": "https://www.rescana.com/post/cve-2026-50656-microsoft-defender-rogueplanet-zero-day-enables-local-privilege-escalation-on-fully-patched-windows-10-11", "retrieval": "search excerpt only", "original_citation": "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 \" 11 Systems.\" Rescana, 18 June 2026.", "display_correction": "Punctuation normalized for display from the archived title; original wording has not been independently checked." }, { "id": 11, "citation": "\"Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656).\" Security Affairs, 9 July 2026. Source for the Windows Server mounting limitation.", "url": "https://securityaffairs.com/195016/security/microsoft-fixed-defender-flaw-rogueplanet-cve-2026-50656.html", "retrieval": "search excerpt only" }, { "id": 12, "citation": "\"CVE-2026-50656 'RoguePlanet': Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM.\" Threat-Modeling.com, 9 July 2026. Source for engine version 1.1.26060.3008.", "url": "https://threat-modeling.com/cve-2026-50656-rogueplanet-microsoft-defender-privilege-escalation/", "retrieval": "search excerpt only" }, { "id": 13, "citation": "\"RoguePlanet LPE Exploit CVE-2026-50656 Analysis.\" femtosec, 14 July 2026. Source for the reported five-second chain and the dark-web exploit sales.", "url": "https://femtosec.io/threat-intelligence/rogueplanet-cve-2026-50656-privilege-escalation", "retrieval": "search excerpt only" }, { "id": 14, "citation": "\"CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM.\" Penligent, 19 June 2026. Source for the detection guidance on privileged security processes.", "url": "https://www.penligent.ai/hackinglabs/cve-2026-50656/", "retrieval": "search excerpt only" }, { "id": 15, "citation": "Microsoft Security Response Center. Security Update Guide entry for CVE-2026-69414. Not retrieved directly; status as reported by references 1 and 9.", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414", "retrieval": "not retrieved" }, { "id": 16, "citation": "CVE Program record, CVE-2026-69414.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69414", "retrieval": "not retrieved" }, { "id": 17, "citation": "\"ShieldBreak In-Depth Analysis.\" CRYPTRON Security GmbH, August 2026. Source for the phase sequence: detected test content served first, payload served on restart hydration, Object Manager links redirected concurrently. Direct retrieval refused by the site's robots policy; search excerpt only.", "url": "https://www.cryptron.ch/en/blog-detail/ShieldBreak-In-Depth-Analysis.html", "retrieval": "search excerpt only, retrieval refused" } ], "local_projection": { "revision": "local-draft-3", "scope": "All 11 archived records, 17 state variables, four cores and 22 graph edges, with explicit public redactions and source-level provenance corrections. This is not an official MC release.", "display_scope_note": "Capability display twins refer only to the operating-system platform and editions modeled in the archived corpus; exact platform and version names remain in formal fields, source scope and citations.", "source_comment_handling": "YAML comments are not machine fields and are not reproduced; actual field values and ontology identifiers are retained except for the enumerated corrections and redactions.", "no_new_results": "No external facts refreshed, empirical test performed, derived model recomputed, conceptual ratification run or deployment assessed." } }