T1106 — Native API - ShieldBreak (Nightmare Eclipse) Exploit Loading MpClient.dll From Non-Standard Location
Nightmare Eclipse released the ShieldBreak Exploit on Aug 11 2026. This exploit is a privilege escalation exploit to SYSTEM leveraging a vulnerability in Windows Defender. Part of this exploit relies on loading the MpClient.dll that Windows Defender uses to perform security scanning. This query looks for evidence of this DLL being loaded by a file not located in a standard Windows Defender-related location. Loading of this file from any other path is anomalous and should be investigated.
Microsoft Sentinel (KQL)
