RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day

A standard user can spawn a SYSTEM shell on a fully patched Windows 10 or 11 box by racing Microsoft Defender's own file handler. Here is what the bug actually is, why it survives the June 2026 patches, and the telemetry you should be hunting on right now.

TL;DR

• RoguePlanet is a proof-of-concept local privilege escalation (LPE) that abuses a Time-of-Check to Time-of-Use (TOCTOU) race condition in Microsoft Defender's file-processing path. A successful run drops a cmd.exe running as NT AUTHORITY\SYSTEM.
• It works against fully patched Windows 10 and Windows 11, including builds carrying the June 2026 Patch Tuesday updates (validated against Windows 11 with KB5094126).
• Nightmare Eclipse dropped it within hours of Microsoft's June 2026 Patch Tuesday – the third month running the actor has timed a zero-day to patch day.
• No CVE and no advisory exist for RoguePlanet as of publication. There is no targeted patch.
• The exploit is a race, so it is probabilistic. Near-100% on some hardware, near-useless on others. That unreliability is an operational footnote, not a mitigating control.
• Application allowlisting blocks it. ThreatLocker independently reproduced the exploit and reported its default allowlisting prevented execution.
• Detection pivots on one strong signal: an interactive shell with SYSTEM integrity whose parent is the Defender engine (MsMpEng.exe), a lineage that should never occur in a healthy environment.

Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform

What Is RoguePlanet?

RoguePlanet is the seventh public zero-day proof-of-concept (PoC) released since early April 2026 by a researcher operating as Nightmare Eclipse, as part of an openly adversarial campaign against Microsoft's disclosure and bug-bounty practices. Like several earlier entries in the series, it targets Microsoft Defender, the security product shipped and enabled by default on every modern Windows endpoint.

The premise is straightforward and uncomfortable: the component meant to protect the endpoint runs with the highest privilege on the system, and an unprivileged attacker can trick it into performing a privileged action on the attacker's behalf. The result is the canonical worst case for an endpoint, arbitrary code execution as SYSTEM.

Technical Analysis: The TOCTOU Race at the Heart of It

Why Defender is the target, not just a victim

Microsoft Defender's scanning and remediation engine runs inside MsMpEng.exe (the Antimalware Service Executable) under the WinDefend service as SYSTEM. That is by design to quarantine, delete, or rewrite a malicious file anywhere on disk, the engine needs maximum privilege. The flip side is that any file operation Defender performs is a SYSTEM-privileged file operation, and if an attacker can influence where that operation lands, they inherit that privilege.

What a TOCTOU race actually is

A TOCTOU (Time-of-Check to Time-of-Use) bug is a logic flaw, not a memory-corruption flaw. The vulnerable code checks a property of a resource (e.g., "this path is a legitimate file I'm allowed to act on") and then uses that resource (e.g., writes to it) as two separate, non-atomic steps. If an attacker can change what the path points to in the window between the check and the use, the privileged code acts on a target it never validated. The "race" is the attacker's effort to swap the target inside that window.

In the Defender case, the privileged engine validates a file path, then performs a write/remediation against it. RoguePlanet's job is to redirect that write away from the intended target and into a location the attacker controls but normally cannot touch (for example, a protected system directory) so that SYSTEM-level code or configuration is planted under attacker control.

The redirection primitive

The redirection technique in this bug family relies on NTFS path-redirection objects, junctions (mount points) and symbolic links, which let a low-privileged user make a path they control resolve to a path they do not. This is a long-established Windows LPE primitive: an unprivileged user stages a directory, then flips it to a reparse point at the right moment so the privileged writer follows the link to a sensitive destination. RoguePlanet's predecessor BlueHammer (CVE-2026-33825, CVSS 7.8) used exactly this shape, junction points that redirected Defender's SYSTEM-level writes into C:\Windows\System32.

Editorial note: This post intentionally describes the bug class and mechanism at the conceptual level that defenders need to reason about detection and hardening. It does not reproduce the PoC, the crafted disk-image internals, or the race-window technique. Those details add nothing to a defensive program.

How it survived the patches

This is the part that should concern blue teams most. According to the researcher, Microsoft silently hardened Defender in mid-May 2026 by patching the internal mpengine!SysIO* family of APIs to blunt junction-based attacks. RoguePlanet was then rewritten specifically to bypass that hardening. In other words, the May mitigation closed one door; the technique found another. The June 2026 Patch Tuesday, which did fix two of the actor's other disclosures (GreenPlasma and YellowKey), left this path open. Patch parity is not coverage parity.

From RCE to LPE: The SMB and VHDX Origin Story

RoguePlanet did not start life as a privilege-escalation bug. Per the researcher's own writeup, the original primitive was a remote code execution condition rooted in how Defender handles files hosted on remote SMB shares:

• The initial RCE chain required coercing a victim into opening a crafted .vhd(x) file from a remote SMB server. Defender's processing of the mounted image resulted in the engine overwriting its own files, yielding RCE.
• A second theorized RCE scenario involved coercing a victim into opening a remote SMB share while symlink evaluation settings were enabled, allowing remote symlinks to steer Defender's file operations.

The mid-May hardening broke these remote paths. The reworked, public version of RoguePlanet is therefore an LPE today, and the researcher openly states it is unclear whether it can be turned back into an RCE. For defenders, the takeaway is that the same attack surface (disk-image handling, remote SMB content, symlink/junction resolution) underpins both the local and remote variants, so the hardening that closes the LPE also shrinks the RCE blast radius.

Threat Actor Profile: Nightmare Eclipse

Nightmare Eclipse (also tracked as Chaotic Eclipse and Dead Eclipse) is an anonymous researcher running what the security press has consistently characterized as a retaliatory campaign against Microsoft over its vulnerability-disclosure and bounty handling. The cadence is aggressive, roughly one new Defender or Windows zero-day every ~10 days across a two-month stretch.

Known prior releases:

Tradecraft and infrastructure worth noting for monitoring and attribution:

• The actor publishes through a blog at deadeclipse666.blogspot.com and historically the GitHub account MSNightmare.
• After repeated takedowns of GitHub and GitLab repositories (the actor attributes these to Microsoft), they moved to a self-hosted code platform at projectnightcrawler.dev. Treat that domain and its mirrors as PoC-distribution infrastructure for watchlisting.
• This is not purely theoretical risk. Huntress reported that earlier Nightmare Eclipse tooling (BlueHammer, RedSun, and UnDefend) was used in a live attack chain, meaning this actor's releases have a track record of being operationalized by real intruders, not just collected by researchers.

Risk Assessment: Why This One Matters

Strip away the drama and four facts define the risk:

1. It is unpatched. No CVE, no advisory, no targeted fix. The window is open now.
2. It defeats current patches. A fully patched June-2026 endpoint is in scope.
3. It targets a universally deployed, always-on component. Defender is the default; the attack surface is effectively your entire Windows fleet.
4. The actor's code gets weaponized. Prior tooling has already appeared in live intrusions.

The one genuine limiter — that it is a race and therefore hit-or-miss — should be read correctly. Unreliable-per-attempt exploits are routinely made reliable in practice through repetition: an attacker who already has a low-priv foothold can loop the attempt until it lands. Probabilistic exploitation lowers convenience, not exposure.

Detection Engineering

You cannot patch what has no patch, so detection is the near-term control. The good news is that the outcome of this exploit class is extraordinarily anomalous and produces clean signal.

Primary signal – anomalous Defender process lineage

Microsoft Defender does not legitimately launch interactive shells or scripting hosts. A cmd.exe, powershell.exe, conhost.exe, cscript.exe, or wscript.exe running at SYSTEM integrity whose ancestry traces to MsMpEng.exe is, for practical purposes, a confirmed exploitation event.

Sigma rule (process creation):

Microsoft Defender for Endpoint – Advanced Hunting (KQL):

This is the highest-fidelity, lowest-noise detection available for this class and should be deployed first.

Secondary signals – the staging that precedes the shell

These are noisier individually but valuable in correlation, and they cover the steps that set up the race before the payload fires:

• Reparse-point / junction creation in user-writable paths. Watch for NTFS junctions and symlinks being created under %TEMP%, %LOCALAPPDATA%, and C:\ProgramData shortly before Defender file activity touches the same area. Sysmon FileCreate (Event ID 11) plus EDR file events (DeviceFileEvents in MDE) provide coverage; minifilter/EDR telemetry is more reliable than native logs for flagging reparse semantics.
• Suspicious virtual disk mounts. The original lure is a crafted .vhd(x). Monitor the Microsoft-Windows-VHDMP/Operational event log for mount operations, and alert on disk-image mounts originating from network paths, %TEMP%, or user download directories, or via Mount-DiskImage / Mount-VHD. Correlate with whether the image carried Mark-of-the-Web.
• Outbound SMB to untrusted hosts. The remote vectors require reaching an attacker SMB share. Alert on outbound TCP/445 (and 139) to non-corporate or external destinations from workstations.

MITRE ATT&CK mapping

Mitigation and Hardening

In priority order for an unpatched window:

1. Application allowlisting — your strongest available control. ThreatLocker reproduced RoguePlanet and confirmed its default allowlisting blocked execution. Equivalent results are achievable with WDAC (App Control for Business) or AppLocker in enforced mode: even if the race wins and a SYSTEM context is obtained, an unapproved payload binary does not run.
2. Constrain virtual-disk handling. Restrict or block automatic mounting of .vhd/.vhdx/.iso files delivered by email or from network locations via Group Policy / Intune. Treat disk images as executables in your content-disarm and email-filtering rules.
3. Harden SMB and symlink evaluation. Block outbound SMB (TCP/445) at the perimeter — a long-standing best practice that also closes the remote vectors here. Verify symlink evaluation remains locked down with fsutil behavior query SymlinkEvaluation; remote-to-local (R2L) and remote-to-remote (R2R) evaluation should stay Disabled (the default). Do not enable them.
4. Enforce least privilege. This is local privilege escalation, it presupposes an existing low-privileged foothold. Removing standing local-admin and tightening initial-access controls reduces the population of machines from which the race can even be attempted.
5. Deploy the detections above and staff them. With no patch, the MsMpEng.exe-parent SYSTEM-shell rule should be a paging-level alert.
6. Watch for an out-of-band fix. Given the public reproduction, live-intrusion history, and Patch-Tuesday timing, an OOB or accelerated Defender platform/engine update is plausible. Confirm Defender platform and engine versions update independently of the monthly cumulative, these often ship through the antimalware update channel rather than Windows Update.

Hunting & IOC Checklist

• Alert: any interactive shell / scripting host with SYSTEM integrity parented by MsMpEng.exe.
• Hunt: reparse-point or symlink creation in %TEMP%, %LOCALAPPDATA%, C:\ProgramData immediately preceding Defender write activity.
• Hunt: .vhd(x) mounts (Microsoft-Windows-VHDMP/Operational) from network/temp/download paths.
• Alert: outbound SMB (445/139) from workstations to external or non-corporate hosts.
• Watchlist: projectnightcrawler.dev, deadeclipse666.blogspot.com, GitHub handle MSNightmare and mirrors, as PoC-distribution infrastructure.
• Verify: WDAC/AppLocker/allowlisting in enforced mode across the Windows fleet.
• Verify: fsutil behavior query SymlinkEvaluation → R2L and R2R Disabled.
• Verify: Defender platform and engine versions current via the antimalware update channel.

Timeline of the Nightmare Eclipse Campaign

How Picus Helps Simulate 0-Day “RoguePlanet” Exploitation Attacks?

We strongly recommend simulating the RoguePlanet exploit to test how effectively your security controls hold up against this Windows Defender privilege-escalation attack, using the Picus Platform. You can also validate your defenses against other vulnerability exploitation attacks (such as regreSSHion, Citrix Bleed, and Follina) within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for RoguePlanet exploitation attacks:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Platform.