RoguePlanet CVE-2026-50656: MsMpEng.exe Spawning SYSTEM-Integrity Shell (TOCTOU LPE)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•10

This rule detects instances where the Microsoft Defender process (MsMpEng.exe) spawns common command-line or scripting interpreters such as cmd, powershell, or wscript with System integrity. This behavior is highly irregular for a security product and may indicate process injection, defensive evasion, or malicious activity masquerading as a legitimate system process.