ShieldBreak · evidence reference
The evidence behind the bounded claims
Curated archival outcomes with exact line ranges and hashes. This trace does not establish current incident status or measured results.
Reference material for the homepage ShieldBreak walkthrough.
Selected exact line ranges from archival formal outcomes. Gaps between ranges are deliberate; this is not the complete archive. Excerpt hashes cover the displayed UTF-8 text joined by LF without a trailing newline. Archival citations retain historical source names and titles, not current guidance. The unchanged historical provenance excerpt uses a blanket derived default. The local-draft-3 corrected public model classifies source-authored record requirements as asserted while preserving their inferred, unmeasured basis; cores, edges and profile terms retain archival derived status. See the model correction manifest for the distinction.
Return to the claims and their qualifications →
The source register records historical access labels: 13 search excerpts, one repository description, one full-text retrieval label and two unavailable sources. No external source was refreshed for this draft. Source support, derived provenance and unrun tests are separate questions.
archive-yaml#invariant_cores/C2
Exact lines 1384–1395
1384 - id: C2 1385 type: mc:InvariantCore # §4.4.3 1386 provenance: derived # estimated by intersection, §4.4.4; NOT measured 1387 identity_status: provisional # §4.4.3: an estimated core has provisional identity 1388 core_requires_state: ["executionContext ⊒ user", "scannerAttention = onAdversaryPath"] # mc:coreRequiresState, §4.4.4 1389 invariant_composes: ["alter the resolved value between the check and the use"] # mc:invariantComposes, §4.4.4 1390 core_requires_effect: [] # mc:coreRequiresEffect, §4.4.4 1391 core_support: 3 # mc:coreSupport, §4.4.5.4 1392 members_observed: [M3, M4, N3] 1393 membership_rule: "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition" 1394 core_subsumed_by: C1 # mc:coreSubsumes, §4.4.5.3 1395 below_support_floor: false # §4.4.4 SHOULD NOT rely on fewer than three
Excerpt SHA-256: 4c2c95231b88ad4a0dab8ca1e280ec865793d5ba10e090c4fefbaf01fef9061d
Exact lines 1397–1397
1397 respond_transfer: none # §4.4.4.3 — empty Q*, so no responding placement transfers
Excerpt SHA-256: 0f4392744f4462c1aa45cef923fed6ff8dabdfa87e0b87eaee0c34e62981efe1
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M3
Exact lines 406–407
406 - id: M3 407 type: mc:ManeuverRecord # §4.4.1
Excerpt SHA-256: 873cd15e0c958ffbb9a71f71abbe6c342aaa313ef9e04daeea3e359decf7ff07
Exact lines 413–414
413 precondition: # mc:hasPreconditionClause, §4.1 414 - clause: "executionContext ⊒ user"
Excerpt SHA-256: bc63b2e459be3c9bce5536296e6b8d3d28f00747163bac93a343fa590f816e88
Exact lines 419–419
419 - clause: "hydrationCallbackOwner = adversary"
Excerpt SHA-256: 276403fa0fe528d711615603b8a2c23b55e3585b9c22170309fdfd709d5ceac9
Exact lines 424–424
424 - clause: "scannerAttention = onAdversaryPath"
Excerpt SHA-256: 863ac9e8d6bdea7b34573d756235beb03da599bd45dffb89e974a1400a0f950b
Exact lines 429–429
429 - clause: "contentRevalidation = absent"
Excerpt SHA-256: 2040a40507850fe21868a5e31249f05968f82c5b874e66e0c44b4d449423ecc2
Exact lines 434–435
434 mechanism: 435 - step: "serve detected test content on the first hydration, so the engine enters remediation"
Excerpt SHA-256: 1da15e4337a6cabc8713ca2bf1d4646cf7325f2e4c335277333f538279c5c28b
Exact lines 437–437
437 - step: "serve different content on the restart hydration that the remediation read triggers"
Excerpt SHA-256: 0b24e45515fe9dfa1ffac96b4ef37497429297c3f1c4140e996269f3bdd5c01d
Exact lines 439–440
439 postcondition: # mc:hasPostconditionClause, §4.1 440 - clause: "privilegedProcessInput = adversaryControlled"
Excerpt SHA-256: d6ffadaa3f3dddaa8f6fb59a8a5474ab27924c1294dbdef36785248e34b35fc0
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M4
Exact lines 546–547
546 - id: M4 547 type: mc:ManeuverRecord # §4.4.1
Excerpt SHA-256: 8d01e31882b04331f5b4c58c91676c597f4653122c90308b2f7569e97c082cab
Exact lines 553–554
553 precondition: # mc:hasPreconditionClause, §4.1 554 - clause: "executionContext ⊒ user"
Excerpt SHA-256: bc63b2e459be3c9bce5536296e6b8d3d28f00747163bac93a343fa590f816e88
Exact lines 559–559
559 - clause: "scannerAttention = onAdversaryPath"
Excerpt SHA-256: 863ac9e8d6bdea7b34573d756235beb03da599bd45dffb89e974a1400a0f950b
Exact lines 564–564
564 - clause: "objectSymlinkCreation ⊒ permittedToUser"
Excerpt SHA-256: 088d47923660bfb2cd96e58c071fe992d47987887abbe1af4351dcbc435695e6
Exact lines 569–569
569 - clause: "objectPathRevalidation = absent"
Excerpt SHA-256: cde6dcdedcb34ff1b50fd2aeba24466bf2a4932a34540e5a2761375f270455fb
Exact lines 574–575
574 mechanism: 575 - step: "rebind Object Manager symbolic links between the engine's path resolution and its use"
Excerpt SHA-256: 5abedb255fa44bbb8dd0363466d90314c8c89bc2a306961c55ee9d1b476e8fc8
Exact lines 577–578
577 postcondition: # mc:hasPostconditionClause, §4.1 578 - clause: "privilegedWriteTarget = adversaryChosen"
Excerpt SHA-256: 257a0123b2184955df9599adc12bf48bb5c4fbe4321be9a6757e4878c30611e0
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/N3
Exact lines 1072–1073
1072 - id: N3 1073 type: mc:ManeuverRecord # §4.4.1
Excerpt SHA-256: 8354e654c00ee83039ab7dc42753f1651ea1f3a2f531a87ce2531f5cc4731265
Exact lines 1079–1080
1079 precondition: # mc:hasPreconditionClause, §4.1 1080 - clause: "executionContext ⊒ user"
Excerpt SHA-256: bc63b2e459be3c9bce5536296e6b8d3d28f00747163bac93a343fa590f816e88
Exact lines 1085–1085
1085 - clause: "scannerAttention = onAdversaryPath"
Excerpt SHA-256: 863ac9e8d6bdea7b34573d756235beb03da599bd45dffb89e974a1400a0f950b
Exact lines 1090–1090
1090 - clause: "junctionCreation ⊒ permittedToUser"
Excerpt SHA-256: 4c17fce45a9b9e47f8a3ee759fdf3e34ac0b5b502f805323d928c40e41563a27
Exact lines 1095–1095
1095 - clause: "junctionPathRevalidation = absent"
Excerpt SHA-256: a832fa2a84fcd75ef34e2533dcd48fceb7245746aedf1a37d46bffdefa86122d
Exact lines 1100–1101
1100 mechanism: 1101 - step: "rebind an NTFS junction between the engine's path check and its quarantine write, repeating until the race is won"
Excerpt SHA-256: 99c6c8f15244b36e18039adb8bc899f22fa795c583960e2cd0a84920bf2da298
Exact lines 1103–1104
1103 postcondition: # mc:hasPostconditionClause, §4.1 1104 - clause: "privilegedWriteTarget = adversaryChosen"
Excerpt SHA-256: 257a0123b2184955df9599adc12bf48bb5c4fbe4321be9a6757e4878c30611e0
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M4/method_notes
Exact lines 681–683
681 method_notes: # framework commentary; strip for public projections 682 - "M3, M4 and N3 align to core C2 and differ only in their variations. §4.7.1 transfers a defensive result across a core only where the placement acts on the invariant, so an engine fix aimed at one variation buys that member and transfers to neither sibling." 683 - "objectPathRevalidation and junctionPathRevalidation are two state variables. Modelled as one, the corpus would report the July fix as closing the class."
Excerpt SHA-256: bb552aa87408d98098b48c12a7bf5a734a14342ce6a95d815d7db13874baa61f
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#provenance
Exact lines 28–35
28 provenance: 29 default_kind: derived # §2.3 30 measured_elements: 0 31 perturbation_runs: 0 # §4.4.3.1; no required-verdict here is measured 32 asserted_from: sources # see references 33 rule: >- 34 Enablement edges, satisfaction verdicts, invariant cores, placement availability 35 and profile terms are derived and MUST NOT be asserted (§2.3).
Excerpt SHA-256: f5adf14f70b8059739377da7bb128b55ec2e800d1869367f49f511b810e58319
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#bindings
Exact lines 11–27
11 bindings: 12 spec: 13 id: MC-SPEC 14 version: 0.4.19-draft 15 sha256: be8b75136580 16 status: WORKING DRAFT, VERIFIED 17 authority: every clause quoted in this corpus was taken from this bundle 18 ontology: 19 id: mc-core 20 version: 0.4.20.1 21 spec_pin: 65b2c0f51cf7 22 binding_status: PROVISIONAL 23 divergence: >- 24 The ontology pins MC-SPEC corpus 65b2c0f51cf7. The clause corpus used here is 25 0.4.19-draft, sha256 be8b75136580. The two do not agree, so every mc: term 26 below is a proposed binding pending a re-pin. No clause text was taken from the 27 ontology deposit.
Excerpt SHA-256: 6af799d7fa167b3cd077cc6f4513fddfe58393160a0ac6f579603660c3cd4f1f
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M4/defensive_design_profile
Exact lines 581–587
581 defensive_design_profile: # mc:DefensiveDesignProfile, §10.5; type altitude, reads no posture 582 - cell: mc:cellPreventAtPrecondition # mc:GridCell, §9.1 583 function: mc:prevent # §9.3 584 locus: mc:preconditionLocus # §9.1 585 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 586 breaks_maneuver: true # mc:breaksManeuver, §9.2 587 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 9ddce538565af93cf7265e50e92a9a7a2dcf90d3a197f71260bdb36ab6015426
Exact lines 592–597
592 - cell: mc:cellDetectAtPrecondition # mc:GridCell, §9.1 593 function: mc:detect # §9.3 594 locus: mc:preconditionLocus # §9.1 595 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 596 breaks_maneuver: false # mc:breaksManeuver, §9.2 597 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 7862f05dd1a4f62d3f55eefebe53bec01ce732b5ce16652d2fcdf20dcc08e62b
Exact lines 602–607
602 - cell: mc:cellRespondAtPrecondition # mc:GridCell, §9.1 603 function: mc:respond # §9.3 604 locus: mc:preconditionLocus # §9.1 605 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 606 breaks_maneuver: true # mc:breaksManeuver, §9.2 607 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 7f90219984d6b55a7e75afebac46d7e4d2c97db7d5a7db039b0712a054090c9e
Exact lines 612–617
612 - cell: mc:cellPreventAtMechanism # mc:GridCell, §9.1 613 function: mc:prevent # §9.3 614 locus: mc:mechanismLocus # §9.1 615 placement_availability: mc:stateNoPlacementAvailable # mc:placementAvailability, §4.6.4, 10.5.1, 10.5.3 616 breaks_maneuver: false # mc:breaksManeuver, §9.2 617 semantics: "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended"
Excerpt SHA-256: f85d48eca78ba766e81bca0c5554dbc0dc003d1e8b4fa8aa0c972730e1f620d3
Exact lines 622–627
622 - cell: mc:cellDetectAtMechanism # mc:GridCell, §9.1 623 function: mc:detect # §9.3 624 locus: mc:mechanismLocus # §9.1 625 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 626 breaks_maneuver: false # mc:breaksManeuver, §9.2 627 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 28f911aef5219d7bb99defb6b401eb441406f557741d61b46f4f364eeabd674c
Exact lines 632–637
632 - cell: mc:cellRespondAtMechanism # mc:GridCell, §9.1 633 function: mc:respond # §9.3 634 locus: mc:mechanismLocus # §9.1 635 placement_availability: mc:stateNoPlacementAvailable # mc:placementAvailability, §10.5.1 636 breaks_maneuver: false # mc:breaksManeuver, §9.2 637 semantics: "no required element at this locus to act on"
Excerpt SHA-256: cc13ebf673b35a2bbb5c305533b860f52d07658e712bd2459837c9a9d5b51189
Exact lines 642–647
642 - cell: mc:cellPreventAtPostcondition # mc:GridCell, §9.1 643 function: mc:prevent # §9.3 644 locus: mc:postconditionLocus # §9.1 645 placement_availability: mc:stateNoPlacementAvailable # mc:placementAvailability, §4.6.4, 10.5.1, 10.5.3 646 breaks_maneuver: false # mc:breaksManeuver, §9.2 647 semantics: "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended"
Excerpt SHA-256: 05342a0c9c0f2bc6499e450b042c48c7e1390701113bbe44cac9c87a6b672e53
Exact lines 652–657
652 - cell: mc:cellDetectAtPostcondition # mc:GridCell, §9.1 653 function: mc:detect # §9.3 654 locus: mc:postconditionLocus # §9.1 655 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 656 breaks_maneuver: false # mc:breaksManeuver, §9.2 657 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 96100dc7569dc0db4817b05c843f097e4be1f0092300cea0513997adda00e46b
Exact lines 662–667
662 - cell: mc:cellRespondAtPostcondition # mc:GridCell, §9.1 663 function: mc:respond # §9.3 664 locus: mc:postconditionLocus # §9.1 665 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 666 breaks_maneuver: true # mc:breaksManeuver, §9.2 667 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 376bda48ca420286bb6fe4f58d5ab8fee163ab35016f687156cec3c696d9eda9
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#export/altitude
Exact lines 9–9
9 altitude: type # §13.1 separates type from occurrence; no occurrence content is present
Excerpt SHA-256: 9033d4a9b37ebbb3fa1feb1d411c3fb23926561e094192ffed08a6ad2e7ca9a1
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#enablement_graph
Exact lines 1412–1417
1412 enablement_graph: 1413 relation: mc:canUnlock # §6.2, property chain yields ∘ establishes ∘ requires 1414 provenance: derived 1415 recompute_rule: "§6.2 — MUST recompute when any triple or value order changes; edges MUST NOT be asserted" 1416 edge_semantics: "§6.2 — an edge says the earlier postcondition establishes at least one clause the later precondition requires; not all of them, and not that the later maneuver becomes available" 1417 reachability_claim: forbidden # §6.2 — an implementation MUST NOT report reachability from a chain of edges alone
Excerpt SHA-256: 24b20fe778451a8d10edf3474c5c1fa9104c12ca52f91d30d0ce7b6fee7adab1
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M5
Exact lines 684–685
684 - id: M5 685 type: mc:ManeuverRecord # §4.4.1
Excerpt SHA-256: 4f488f3839994c34d89a9fec9f3e755339f85e180f5107a757cac13e914c2926
Exact lines 691–692
691 precondition: # mc:hasPreconditionClause, §4.1 692 - clause: "executionContext ⊒ user"
Excerpt SHA-256: bc63b2e459be3c9bce5536296e6b8d3d28f00747163bac93a343fa590f816e88
Exact lines 697–697
697 - clause: "privilegedProcessInput = adversaryControlled"
Excerpt SHA-256: 083abe046ab4b42479ee3a581e4ae10228ec9318babed714902fbd670ca8343d
Exact lines 702–702
702 - clause: "privilegedWriteTarget = adversaryChosen"
Excerpt SHA-256: e9bc506680f9a9dafb180af0095fe9eeb1f1a54c7c34400f69e4034aad108dcc
Exact lines 707–708
707 mechanism: 708 - step: "let the engine's remediation write complete under its own token"
Excerpt SHA-256: a6d9632ceff135531bd92a4665134875dfc806a80361567550a655f400f32840
Exact lines 710–710
710 - step: "have the written image loaded in the privileged context"
Excerpt SHA-256: ad7121363191cd6d88c02fa55d42e79450a2cdf1ac24bb0398da5e0a586b0be3
Exact lines 712–713
712 postcondition: # mc:hasPostconditionClause, §4.1 713 - clause: "executionContext = SYSTEM"
Excerpt SHA-256: f91803d78b72607e17b51c8d7ffe1e5632ef5893b3273585d59e1cb1dd66e199
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/M5/variation_against_core
Exact lines 809–814
809 variation_against_core: # mc:Variation, mc:variationAgainstCore, §4.4.4.1 810 core: C3 811 tier: mc:VariationTier # mc:tierAgainstCore, §4.4.3.2 812 still_required_by_record: true # §4.4.4.1 — a variation is required beyond the core, not dropped 813 elements: 814 - element: "privilegedProcessInput = adversaryControlled"
Excerpt SHA-256: 24d28cb0a28e71d52932249bb74ce360d8d0309650d105f504c0e9f876cb45a7
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#invariant_cores/C3
Exact lines 1398–1409
1398 - id: C3 1399 type: mc:InvariantCore # §4.4.3 1400 provenance: derived # estimated by intersection, §4.4.4; NOT measured 1401 identity_status: provisional # §4.4.3: an estimated core has provisional identity 1402 core_requires_state: ["executionContext ⊒ user", "privilegedWriteTarget = adversaryChosen"] # mc:coreRequiresState, §4.4.4 1403 invariant_composes: ["let the privileged write land at the chosen target and be executed"] # mc:invariantComposes, §4.4.4 1404 core_requires_effect: ["executionContext = SYSTEM"] # mc:coreRequiresEffect, §4.4.4 1405 core_support: 2 # mc:coreSupport, §4.4.5.4 1406 members_observed: [M5, N4] 1407 membership_rule: "§4.4.5.1 — membership MUST NOT be an enumerated list; members_observed is a report, not a definition" 1408 core_subsumed_by: C0 # mc:coreSubsumes, §4.4.5.3 1409 below_support_floor: true # §4.4.4 SHOULD NOT rely on fewer than three
Excerpt SHA-256: a14771e9759b0e60d30904f08d57482b0c439e2bc4bcbffe969368afdd1826df
Exact lines 1411–1411
1411 respond_transfer: class_wide # mc:resultTransfersTo, §4.7.1; scope mc:scopeClassWide, §4.7.3
Excerpt SHA-256: 4e57a3ec5eaff2dd71b2f641a191854b08f1db2db8d62377db4a71b34707d592
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/15
Exact lines 1633–1636
1633 - id: 15 1634 citation: "Microsoft Security Response Center. Security Update Guide entry for CVE-2026-69414. Not retrieved directly; status as reported by references 1 and 9." 1635 url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414" 1636 retrieval: "not retrieved"
Excerpt SHA-256: 23d2b5b9eb779495d1f4247f6663dacd894f6367fb6adb990a7026a244ac1356
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/16
Exact lines 1637–1640
1637 - id: 16 1638 citation: "CVE Program record, CVE-2026-69414." 1639 url: "https://www.cve.org/CVERecord?id=CVE-2026-69414" 1640 retrieval: "not retrieved"
Excerpt SHA-256: ed3ce306db5eb5513a034090fcd0b3fab677e070cc8de792cfd0eba66587247d
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/1
Exact lines 1577–1580
1577 - id: 1 1578 citation: "Sheel, Vamika. \"CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days.\" Qualys Blog, 25 August 2026, updated 3 September 2026." 1579 url: "https://blog.qualys.com/product-tech/2026/08/24/shieldbreak-the-windows-defender-zero-day-with-no-patch-detect-it-mitigate-it-with-qualys" 1580 retrieval: "full text retrieved 2026-09-05"
Excerpt SHA-256: a03bc72ea5680be33d4d95404f9a79cfa853680d29f018911afecbf88901890b
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/2
Exact lines 1581–1584
1581 - id: 2 1582 citation: "\"ShieldBreak: A Local Privilege Escalation Path Through Microsoft Defender.\" CyberMaxx, August 2026." 1583 url: "https://www.cybermaxx.com/resources/shieldbreak-a-local-privilege-escalation-path-through-microsoft-defender/" 1584 retrieval: "search excerpt only"
Excerpt SHA-256: bad7950202a9ae9438cf33ef3f8843aa7f11d54e9446d1315ef769f69fa4d589
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/3
Exact lines 1585–1588
1585 - id: 3 1586 citation: "\"Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak).\" Arctic Wolf, August 2026." 1587 url: "https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/" 1588 retrieval: "search excerpt only"
Excerpt SHA-256: cd8ca5973f1266c348730921a860226e766a801041ca67be602e6e79e08624ae
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/4
Exact lines 1589–1592
1589 - id: 4 1590 citation: "\"ShieldBreak bypasses Microsoft's patch for earlier Defender flaw.\" Malwarebytes Labs, August 2026." 1591 url: "https://www.malwarebytes.com/blog/bugs/2026/08/shieldbreak-bypasses-microsofts-patch-for-earlier-defender-flaw" 1592 retrieval: "search excerpt only"
Excerpt SHA-256: 9c8c96735111daaf5fd05368865ebb5d47f3dfeb9cf8a080c10b54a3c0aa2dcd
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/5
Exact lines 1593–1596
1593 - id: 5 1594 citation: "\"New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges.\" BleepingComputer, August 2026." 1595 url: "https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/" 1596 retrieval: "search excerpt only"
Excerpt SHA-256: 849592cddfba4774d14638ce4caeed332924484cc1d6b4c6a158647780e89126
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/6
Exact lines 1597–1600
1597 - id: 6 1598 citation: "\"Microsoft working on Defender patch for ShieldBreak zero-day.\" BleepingComputer, August 2026. Carries Will Dormann's confirmation that the exploit works and that Defender must be enabled." 1599 url: "https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/" 1600 retrieval: "search excerpt only"
Excerpt SHA-256: 4c4509ce6c8eba20a9f154a49bb6435dba2c65bb049b64512cc302f2bee4b12b
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/7
Exact lines 1601–1604
1601 - id: 7 1602 citation: "\"ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access.\" The Hacker News, 13 August 2026 (updated after publication)." 1603 url: "https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html" 1604 retrieval: "search excerpt only"
Excerpt SHA-256: fa735771d4d06a97419246990d3013e467c618b99cc244a5a8107eee04785c29
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/8
Exact lines 1605–1608
1605 - id: 8 1606 citation: "MSNightmare. \"ShieldBreak \" Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced." 1607 url: "https://github.com/MSNightmare/ShieldBreak" 1608 retrieval: "repository description only"
Excerpt SHA-256: d61ef67eeee38257c2ccb62b8a30159fd2571ecd7f354b9da9d34a9ba000f8f7
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/9
Exact lines 1609–1612
1609 - id: 9 1610 citation: "\"CVE-2026-69414 Defender Flaw Has No Fix or Affected Builds.\" Windows Forum, 3 September 2026." 1611 url: "https://windowsforum.com/windows-news.4/cve-2026-69414-defender-flaw-has-no-fix-or-affected-builds.443144/" 1612 retrieval: "search excerpt only"
Excerpt SHA-256: 857426a17b01f66e67f4747103915495790f8a401df7adfeac753efebb89766a
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/10
Exact lines 1613–1616
1613 - id: 10 1614 citation: "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 \" 11 Systems.\" Rescana, 18 June 2026." 1615 url: "https://www.rescana.com/post/cve-2026-50656-microsoft-defender-rogueplanet-zero-day-enables-local-privilege-escalation-on-fully-patched-windows-10-11" 1616 retrieval: "search excerpt only"
Excerpt SHA-256: e2494eab72e47aa3f29282457a312f9447315cb6e95e438e9b981bde0d8a03bd
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/11
Exact lines 1617–1620
1617 - id: 11 1618 citation: "\"Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656).\" Security Affairs, 9 July 2026. Source for the Windows Server mounting limitation." 1619 url: "https://securityaffairs.com/195016/security/microsoft-fixed-defender-flaw-rogueplanet-cve-2026-50656.html" 1620 retrieval: "search excerpt only"
Excerpt SHA-256: ac0cb8dd8e1dc9cefed84d99e9c3b7e536f097fef4d95733270ba596eefeb3bc
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/12
Exact lines 1621–1624
1621 - id: 12 1622 citation: "\"CVE-2026-50656 'RoguePlanet': Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM.\" Threat-Modeling.com, 9 July 2026. Source for engine version 1.1.26060.3008." 1623 url: "https://threat-modeling.com/cve-2026-50656-rogueplanet-microsoft-defender-privilege-escalation/" 1624 retrieval: "search excerpt only"
Excerpt SHA-256: 20ca42e4203ea53fd894f7192597f1900a60286b295c05115dd94ae3249b2d15
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/13
Exact lines 1625–1628
1625 - id: 13 1626 citation: "\"RoguePlanet LPE Exploit CVE-2026-50656 Analysis.\" femtosec, 14 July 2026. Source for the reported five-second chain and the dark-web exploit sales." 1627 url: "https://femtosec.io/threat-intelligence/rogueplanet-cve-2026-50656-privilege-escalation" 1628 retrieval: "search excerpt only"
Excerpt SHA-256: d25be5591b8722a62ee6f117126f2048b44915f237bdcf8b4f88b3163f94fd27
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/14
Exact lines 1629–1632
1629 - id: 14 1630 citation: "\"CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM.\" Penligent, 19 June 2026. Source for the detection guidance on privileged security processes." 1631 url: "https://www.penligent.ai/hackinglabs/cve-2026-50656/" 1632 retrieval: "search excerpt only"
Excerpt SHA-256: 0c861eb60b645d4fb16164a91e3f8a4af6e80fb16f8d5cc31dae9f2e5fae299f
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references/17
Exact lines 1641–1644
1641 - id: 17 1642 citation: "\"ShieldBreak In-Depth Analysis.\" CRYPTRON Security GmbH, August 2026. Source for the phase sequence: detected test content served first, payload served on restart hydration, Object Manager links redirected concurrently. Direct retrieval refused by the site's robots policy; search excerpt only." 1643 url: "https://www.cryptron.ch/en/blog-detail/ShieldBreak-In-Depth-Analysis.html" 1644 retrieval: "search excerpt only, retrieval refused"
Excerpt SHA-256: 541342ea90123b3f9e770724b4ffe9056fb8af422be82d7bd73a584ea948df0e
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#records/N3/defensive_design_profile
Exact lines 1107–1113
1107 defensive_design_profile: # mc:DefensiveDesignProfile, §10.5; type altitude, reads no posture 1108 - cell: mc:cellPreventAtPrecondition # mc:GridCell, §9.1 1109 function: mc:prevent # §9.3 1110 locus: mc:preconditionLocus # §9.1 1111 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 1112 breaks_maneuver: true # mc:breaksManeuver, §9.2 1113 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 9ddce538565af93cf7265e50e92a9a7a2dcf90d3a197f71260bdb36ab6015426
Exact lines 1118–1123
1118 - cell: mc:cellDetectAtPrecondition # mc:GridCell, §9.1 1119 function: mc:detect # §9.3 1120 locus: mc:preconditionLocus # §9.1 1121 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 1122 breaks_maneuver: false # mc:breaksManeuver, §9.2 1123 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 7862f05dd1a4f62d3f55eefebe53bec01ce732b5ce16652d2fcdf20dcc08e62b
Exact lines 1128–1133
1128 - cell: mc:cellRespondAtPrecondition # mc:GridCell, §9.1 1129 function: mc:respond # §9.3 1130 locus: mc:preconditionLocus # §9.1 1131 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 1132 breaks_maneuver: true # mc:breaksManeuver, §9.2 1133 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 7f90219984d6b55a7e75afebac46d7e4d2c97db7d5a7db039b0712a054090c9e
Exact lines 1138–1143
1138 - cell: mc:cellPreventAtMechanism # mc:GridCell, §9.1 1139 function: mc:prevent # §9.3 1140 locus: mc:mechanismLocus # §9.1 1141 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 1142 breaks_maneuver: true # mc:breaksManeuver, §9.2 1143 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 9c757701bf25120fb43eea072f404a84864b81aec4604f70512182a34459292c
Exact lines 1148–1153
1148 - cell: mc:cellDetectAtMechanism # mc:GridCell, §9.1 1149 function: mc:detect # §9.3 1150 locus: mc:mechanismLocus # §9.1 1151 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 1152 breaks_maneuver: false # mc:breaksManeuver, §9.2 1153 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 28f911aef5219d7bb99defb6b401eb441406f557741d61b46f4f364eeabd674c
Exact lines 1158–1163
1158 - cell: mc:cellRespondAtMechanism # mc:GridCell, §9.1 1159 function: mc:respond # §9.3 1160 locus: mc:mechanismLocus # §9.1 1161 placement_availability: mc:stateNoPlacementAvailable # mc:placementAvailability, §10.5.1 1162 breaks_maneuver: false # mc:breaksManeuver, §9.2 1163 semantics: "no required element at this locus to act on"
Excerpt SHA-256: cc13ebf673b35a2bbb5c305533b860f52d07658e712bd2459837c9a9d5b51189
Exact lines 1168–1173
1168 - cell: mc:cellPreventAtPostcondition # mc:GridCell, §9.1 1169 function: mc:prevent # §9.3 1170 locus: mc:postconditionLocus # §9.1 1171 placement_availability: mc:stateNoPlacementAvailable # mc:placementAvailability, §4.6.4, 10.5.1, 10.5.3 1172 breaks_maneuver: false # mc:breaksManeuver, §9.2 1173 semantics: "required, and no defender-reachable value defeats it; reports unreachable-by-defender and MUST NOT report defended"
Excerpt SHA-256: 05342a0c9c0f2bc6499e450b042c48c7e1390701113bbe44cac9c87a6b672e53
Exact lines 1178–1183
1178 - cell: mc:cellDetectAtPostcondition # mc:GridCell, §9.1 1179 function: mc:detect # §9.3 1180 locus: mc:postconditionLocus # §9.1 1181 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §9.2 1182 breaks_maneuver: false # mc:breaksManeuver, §9.2 1183 semantics: "a detect placement; structurally breaks nothing at any locus"
Excerpt SHA-256: 96100dc7569dc0db4817b05c843f097e4be1f0092300cea0513997adda00e46b
Exact lines 1188–1193
1188 - cell: mc:cellRespondAtPostcondition # mc:GridCell, §9.1 1189 function: mc:respond # §9.3 1190 locus: mc:postconditionLocus # §9.1 1191 placement_availability: mc:statePlacementUnplaced # mc:placementAvailability, §10.5.1, 10.5.3, 9.2 1192 breaks_maneuver: true # mc:breaksManeuver, §9.2 1193 semantics: "a placement here structurally breaks the record and the defeating value is defender-reachable"
Excerpt SHA-256: 376bda48ca420286bb6fe4f58d5ab8fee163ab35016f687156cec3c696d9eda9
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#references
Exact lines 1576–1644
1576 references: 1577 - id: 1 1578 citation: "Sheel, Vamika. \"CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days.\" Qualys Blog, 25 August 2026, updated 3 September 2026." 1579 url: "https://blog.qualys.com/product-tech/2026/08/24/shieldbreak-the-windows-defender-zero-day-with-no-patch-detect-it-mitigate-it-with-qualys" 1580 retrieval: "full text retrieved 2026-09-05" 1581 - id: 2 1582 citation: "\"ShieldBreak: A Local Privilege Escalation Path Through Microsoft Defender.\" CyberMaxx, August 2026." 1583 url: "https://www.cybermaxx.com/resources/shieldbreak-a-local-privilege-escalation-path-through-microsoft-defender/" 1584 retrieval: "search excerpt only" 1585 - id: 3 1586 citation: "\"Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak).\" Arctic Wolf, August 2026." 1587 url: "https://arcticwolf.com/resources/blog/cve-2026-50656-rogueplanet-shieldbreak/" 1588 retrieval: "search excerpt only" 1589 - id: 4 1590 citation: "\"ShieldBreak bypasses Microsoft's patch for earlier Defender flaw.\" Malwarebytes Labs, August 2026." 1591 url: "https://www.malwarebytes.com/blog/bugs/2026/08/shieldbreak-bypasses-microsofts-patch-for-earlier-defender-flaw" 1592 retrieval: "search excerpt only" 1593 - id: 5 1594 citation: "\"New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges.\" BleepingComputer, August 2026." 1595 url: "https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldbreak-zero-day-grants-system-privileges/" 1596 retrieval: "search excerpt only" 1597 - id: 6 1598 citation: "\"Microsoft working on Defender patch for ShieldBreak zero-day.\" BleepingComputer, August 2026. Carries Will Dormann's confirmation that the exploit works and that Defender must be enabled." 1599 url: "https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/" 1600 retrieval: "search excerpt only" 1601 - id: 7 1602 citation: "\"ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access.\" The Hacker News, 13 August 2026 (updated after publication)." 1603 url: "https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html" 1604 retrieval: "search excerpt only" 1605 - id: 8 1606 citation: "MSNightmare. \"ShieldBreak \" Windows Defender 0day vulnerability.\" GitHub repository, August 2026. Repository description only; no exploit content was read, retrieved or reproduced." 1607 url: "https://github.com/MSNightmare/ShieldBreak" 1608 retrieval: "repository description only" 1609 - id: 9 1610 citation: "\"CVE-2026-69414 Defender Flaw Has No Fix or Affected Builds.\" Windows Forum, 3 September 2026." 1611 url: "https://windowsforum.com/windows-news.4/cve-2026-69414-defender-flaw-has-no-fix-or-affected-builds.443144/" 1612 retrieval: "search excerpt only" 1613 - id: 10 1614 citation: "\"CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 \" 11 Systems.\" Rescana, 18 June 2026." 1615 url: "https://www.rescana.com/post/cve-2026-50656-microsoft-defender-rogueplanet-zero-day-enables-local-privilege-escalation-on-fully-patched-windows-10-11" 1616 retrieval: "search excerpt only" 1617 - id: 11 1618 citation: "\"Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656).\" Security Affairs, 9 July 2026. Source for the Windows Server mounting limitation." 1619 url: "https://securityaffairs.com/195016/security/microsoft-fixed-defender-flaw-rogueplanet-cve-2026-50656.html" 1620 retrieval: "search excerpt only" 1621 - id: 12 1622 citation: "\"CVE-2026-50656 'RoguePlanet': Microsoft Defender Malware Protection Engine Privilege Escalation to SYSTEM.\" Threat-Modeling.com, 9 July 2026. Source for engine version 1.1.26060.3008." 1623 url: "https://threat-modeling.com/cve-2026-50656-rogueplanet-microsoft-defender-privilege-escalation/" 1624 retrieval: "search excerpt only" 1625 - id: 13 1626 citation: "\"RoguePlanet LPE Exploit CVE-2026-50656 Analysis.\" femtosec, 14 July 2026. Source for the reported five-second chain and the dark-web exploit sales." 1627 url: "https://femtosec.io/threat-intelligence/rogueplanet-cve-2026-50656-privilege-escalation" 1628 retrieval: "search excerpt only" 1629 - id: 14 1630 citation: "\"CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM.\" Penligent, 19 June 2026. Source for the detection guidance on privileged security processes." 1631 url: "https://www.penligent.ai/hackinglabs/cve-2026-50656/" 1632 retrieval: "search excerpt only" 1633 - id: 15 1634 citation: "Microsoft Security Response Center. Security Update Guide entry for CVE-2026-69414. Not retrieved directly; status as reported by references 1 and 9." 1635 url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414" 1636 retrieval: "not retrieved" 1637 - id: 16 1638 citation: "CVE Program record, CVE-2026-69414." 1639 url: "https://www.cve.org/CVERecord?id=CVE-2026-69414" 1640 retrieval: "not retrieved" 1641 - id: 17 1642 citation: "\"ShieldBreak In-Depth Analysis.\" CRYPTRON Security GmbH, August 2026. Source for the phase sequence: detected test content served first, payload served on restart hydration, Object Manager links redirected concurrently. Direct retrieval refused by the site's robots policy; search excerpt only." 1643 url: "https://www.cryptron.ch/en/blog-detail/ShieldBreak-In-Depth-Analysis.html" 1644 retrieval: "search excerpt only, retrieval refused"
Excerpt SHA-256: f51ccef674fc9c223c4125e5e642a8d8c67a810fa05ca301a2dc5488f648fd82
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.
archive-yaml#completeness_claim
Exact lines 1529–1538
1529 completeness_claim: # mc:completenessClaimKind, §4.3.3 1530 scope_named: true # §4.3.3 — a claim whose scope is unstated is not a claim 1531 closed_over: ["CVE-2026-69414 as reported", "CVE-2026-50656 as reported", "references 1-17"] 1532 not_closed_over: ["either exploit binary", "engine internals", "Windows 10 variance", "post-escalation stages"] 1533 unasserted_within_scope_evaluates: absent # §4.3.3 1534 unasserted_outside_scope_evaluates: unmodeled # §4.3.3, §10.4; MUST NOT default to absent or present 1535 declared_silence_carried: # §14.3 1536 - "§6.3 — frame conditions and parallel-chain interference are unspecified in the bound draft" 1537 draft_caveat: "§1.5 — the conceptual ratification suite has not been run against the bound text" 1538 exclusions_for_ambient_clause: 0 # §4.6.5
Excerpt SHA-256: 428f491f281a18243fc2feb3eebf3452b37f5e7eb4c6abfd7427fd39e230bc32
Archived formal record corpus 0.4.0 · snapshot 2026-09-05 · entire archived source SHA-256: 24c92ecaa2df4516eb8d9a40e0e786b2f76512c8d3d5d8755b51695841f1af70.