RoguePlanet: MsMpEng.exe Spawning SYSTEM-Integrity Shell (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.