Unexpected SYSTEM token elevation from non-SYSTEM shell following Defender activity (ShieldBreak CVE-2026-50656)
This rule detects privilege escalation attempts by monitoring for cmd.exe, powershell.exe, or whoami.exe processes executing with SYSTEM privileges that were spawned by a non-SYSTEM user. It correlates these events with concurrent activity from the Microsoft Defender service (MsMpEng.exe) within a five-minute window, identifying a behavioral pattern consistent with the ShieldBreak (CVE-2026-50656) exploit chain, which leverages Defender to facilitate token elevation.
Microsoft Sentinel (KQL)
