nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

UnDefend Proof-of-Concept Targets Windows Defender Update Availability

Du'aine Davis · 2026-04-17T12:09:04+00:00

Observed in the wild * A publicly available GitHub repository, UnDefend, demonstrates a proof‑of‑concept denial‑of‑service condition against Microsoft Defender by intentionally disrupting its ability to update and function correctly. While published as research rather than a campaign, Huntress has reported observing…

Du'aine Davis

Observed in the wild

A publicly available GitHub repository, UnDefend, demonstrates a proof‑of‑concept denial‑of‑service condition against Microsoft Defender by intentionally disrupting its ability to update and function correctly. While published as research rather than a campaign, Huntress has reported observing UnDefend usage alongside related Nightmare‑Eclipse tools (BlueHammer and RedSun) during intrusions in April.
The UnDefend illustrates techniques to disrupt Defender’s operational state, including blocking security intelligence updates and destabilising Defender under certain update conditions. Huntress reporting suggests these techniques have been chained with other Nightmare‑Eclipse tooling during hands‑on‑keyboard activity, post‑compromise, rather than used for initial access.
Defenders are advised monitor for Defender health degradation indicators, including repeated update failures, signature staleness, or unexpected service instability. Enable and enforce Microsoft Defender Tamper Protection, scrutinise low‑privilege execution of binaries attempting to interfere with Defender processes, and correlate local Defender status with central telemetry to detect mismatches that may indicate manipulation rather than normal operation.

GitHub - Nightmare-Eclipse/UnDefend: Repository hosting windows defender DOS tool · GitHub Huntress (@HuntressLabs): " use of Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.| XCancel

Find more posts tagged with

Threat Landscape

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Comments

Du'aine Davis

Nightmare‑Eclipse Activity Expands with New BitLocker Bypass and Privilege Escalation PoCs
For awareness

As an update to previously reported April intrusions involving Nightmare‑Eclipse tooling (including UnDefend), two additional proof‑of‑concept tools, YellowKey and GreenPlasma, have been publicly released via GitHub. These disclosures are not tied to confirmed in‑the‑wild use but provide visibility into additional techniques within the same tooling ecosystem.
The newly released proof‑of‑concepts introduce two distinct techniques: YellowKey, which demonstrates a potential BitLocker bypass scenario, and GreenPlasma, which abuses ctfmon.exe to achieve local privilege escalation via arbitrary section creation. Both are positioned as standalone research tools and illustrate methods for privilege escalation and bypassing data protection controls post‑compromise.
Organisations are advised to use Microsoft Defender to monitor for abnormal ctfmon.exe behaviour, including unusual child processes or execution patterns. Alert on unexpected changes to BitLocker configuration or protection state, and on low‑privilege processes interacting with security‑sensitive components. Enforce Tamper Protection and correlate endpoint telemetry to identify privilege escalation attempts or suspicious system-level modifications.

GitHub - Nightmare-Eclipse/GreenPlasma: GreenPlasma Windows CTFMON Arbitrary Section Creation Elevation of Privileges Vulnerability · GitHub

GitHub - Nightmare-Eclipse/YellowKey: YellowKey Bitlocker Bypass Vulnerability · GitHub

Du'aine Davis

MiniPlasma PoC demonstrates persistence of CVE-2020-17103 vulnerability
For awareness

As a follow‑on to earlier April activity involving Nightmare‑Eclipse tooling, a PoC (“MiniPlasma”) has been published on GitHub. It demonstrates that CVE‑2020‑17103, previously reported and believed patched, remains exploitable. While no confirmed in‑the‑wild use is linked, the release expands the same research ecosystem seen with YellowKey and GreenPlasma, indicating continued development of post‑compromise privilege escalation techniques.
MiniPlasma targets the Windows cldflt.sys driver, exploiting the HsmOsBlockPlaceholderAccess routine using a previously disclosed flaw. The PoC reproduces the original Google Project Zero technique and leverages a race condition to achieve local privilege escalation, enabling SYSTEM‑level execution. This aligns with prior Nightmare‑Eclipse tooling focused on abusing legitimate components to elevate privileges post‑access.
Organisations should prioritise detection of privilege escalation over assumed patch coverage. Using Microsoft Defender, monitor for anomalous SYSTEM‑level process creation, unusual interactions with cldflt.sys, and race‑condition style access patterns. Correlate with prior signals (e.g. suspicious ctfmon.exe activity) and investigate kernel‑level exploit indicators. Enforce least privilege and ensure endpoint telemetry is tuned to flag abnormal token elevation and driver abuse.

GitHub - Nightmare-Eclipse/MiniPlasma: CVE-2020-17103 was apparently not patched or the patch was reversed, regardless this the PoC for an LPE in cldflt.sys

Du'aine Davis

RoguePlanet Public PoC Highlights New Microsoft Defender Privilege Escalation Risk

In June, a public proof-of-concept named RoguePlanet was released on GitHub by MSNightmare, demonstrating a Microsoft Defender local privilege escalation issue on patched Windows 10 and Windows 11 systems. The repository states successful exploitation can spawn a SYSTEM shell, highlighting the operational risk posed by flaws in default, high-privilege security components that are widely deployed across enterprise estates.
According to the repository, the exploit abuses a race condition and is described as “hit or miss”, with reliability varying by machine. The author states the proof-of-concept was tested on Windows 10 and Windows 11 with the June 2026 patch installed, and asserts Windows Server is also vulnerable, although the published method does not directly work there due to implementation constraints.
Although this is currently a public proof-of-concept rather than confirmed in-the-wild exploitation, organisations should monitor for unusual Defender-related activity leading to elevated command execution. In Microsoft Defender/XDR, investigate unexpected SYSTEM-level shells or anomalous child processes associated with Defender operations, and track vendor guidance closely given the software’s privileged position and broad enterprise deployment.

GitHub - MSNightmare/RoguePlanet: RoguePlanet Windows Defender Vulnerability · GitHub

See what's trending

Click on a tag to discover all the published content related to it.