Windows Defender (Microsoft Malware Protection Engine versions prior to 1.1.26060.3008)
Microsoft's built-in antivirus and security tool included with every modern Windows installation.
Root Cause
The flaw exists in how the Malware Protection Engine processes certain inputs, failing to enforce the boundary between standard user and SYSTEM-level operations. An attacker who has already gained a foothold on a device as a basic user can exploit this gap to take full control.
Attack Vector
This is a post-compromise tool, not a remote entry point. An attacker needs existing local access first. Once inside as a standard user, exploiting the flaw elevates them to SYSTEM, allowing credential dumping, tampering with security telemetry, and installing persistent backdoors. A public proof-of-concept exists, published by the researcher "Nightmare-Eclipse."
Detection Notes
Monitor for unexpected SYSTEM-level process spawning from standard user sessions. Watch for unusual scheduled task creation or modifications to Defender configuration. Review endpoint logs for privilege-escalation patterns immediately following any initial access alert.
Recommended Actions
- Apply the out-of-band patch — update Microsoft Malware Protection Engine to version 1.1.26060.3008 or later immediately via Windows Update.
- Restrict local access to sensitive systems and enforce least-privilege account policies.
- Monitor Microsoft Defender telemetry and SIEM logs for anomalous SYSTEM-level activity.