RoguePlanet — Microsoft Defender SYSTEM Escalation Zero-Day

Looks for: MsMpEng.exe as the parent of a shell or scripting host. Accomplishes: catches the moment of SYSTEM code execution — the flagship signal, no benign equivalent.

// HUNT: Defender engine spawning an interactive shell or script host
// MITRE: T1068, T1059.001, T1059.003, T1548 | CONF: high  FP: low  COST: low
// FP NOTES: Defender legitimately launches MpCmdRun.exe / MsMpEngCP.exe, never interactive shells
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^MsMpEng\.exe$/i
| FileName=/^(cmd|powershell|powershell_ise|pwsh|conhost|cscript|wscript|mshta|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, AuthenticationId, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: any child of MsMpEng.exe that is not a known Defender helper. FP: Defender helpers (MpCmdRun.exe, NisSrv.exe) — excluded; validate per platform version.

// HUNT: Anomalous child process of the Microsoft Defender engine
// MITRE: T1068, T1574 | CONF: high  FP: low-med  COST: low
// TUNING: exclude the known Defender helper set; alert on anything else parented by MsMpEng.exe
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^MsMpEng\.exe$/i
| FileName!=/^(MpCmdRun|MsMpEngCP|NisSrv|MpDlpService|MsSense|SenseIR|SenseCncProxy|MpDefenderCoreService)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: MsMpEng.exe as the writing process for a PE in System32/SysWOW64/Program Files. Accomplishes: catches the redirected SYSTEM write — the outcome of the junction race.

// HUNT: Defender engine writing a PE into a protected system directory
// MITRE: T1574, T1068 | CONF: medium  FP: low  COST: low-med
// FP NOTES: Defender writes signatures/platform binaries into its OWN dirs, excluded below
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| ContextBaseFileName=/^MsMpEng\.exe$/i
| TargetFileName=/\\(System32|SysWOW64|Program Files( \(x86\))?)\\/i
| TargetFileName!=/\\(Windows Defender|Microsoft\\Windows Defender|Microsoft\\Windows Security)\\/i
| table([@timestamp, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: endpoints making SMB (TCP 445) connections to public IPs. FP: Azure Files / cloud SMB — exclude known cloud-SMB CIDRs.

// HUNT: Outbound SMB from an endpoint to an external (non-RFC1918) host
// MITRE: T1021.002, T1080 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude RFC1918 + sanctioned cloud-SMB CIDRs; scope to workstation host groups
#event_simpleName=NetworkConnectIP4
| RemotePort=445
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort], limit=200)

Looks for: resolution of the group's known exploit-hosting / disclosure domains. Investigate-only, perishable infrastructure.

// HUNT: DNS resolution of known Nightmare Eclipse / RoguePlanet infrastructure
// MITRE: T1071 | CONF: high  FP: low  COST: low
// FP NOTES: security researchers / sandboxes intentionally resolving the domains
#event_simpleName=DnsRequest
| DomainName=/(^|\.)projectnightcrawler\.dev$|(^|\.)deadeclipse666\.blogspot\.com$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: a process running as SYSTEM (AuthenticationId 999) whose image sits in a user temp / ProgramData path. FP: SYSTEM-context installers from %TEMP% — pair with Q1/Q3 on same host.

// HUNT: SYSTEM-integrity process launched from a user-writable directory
// MITRE: T1068, T1574, T1059 | CONF: low-med  FP: medium  COST: low-med
// TUNING: correlate to Q1/Q3 on same aid; exclude known signed installer/update paths
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| AuthenticationId=999
| ImageFileName=/\\(Users\\[^\\]+\\AppData\\Local\\Temp|ProgramData)\\.+\.(exe|dll|scr)$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)