WER crash report for MsMpEng.exe matching ShieldBreak crash signature

Duo Tech@duotech

•updated Aug 12, 2026•7•0•25

Detects a Windows Error Reporting (WER) crash report for MsMpEng.exe whose fault signature matches the ShieldBreak exploit crash pattern, indicating the Defender process crashed as a byproduct of the TOCTOU exploitation attempt. Excludes routine crashes tied to signature/platform updates.