Sunturai
Back to results
MediumSplunk security contentOnur Mustafa Erdogan +1

Windows Defender Threat Detected on Kernel Object Path

The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). It leverages Windows Defender…

Description

The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
windows_event_log_defender_1116windows_event_log_defender_1117

Known benign triggers

  • No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice