RoguePlanet Exploit Uses Windows Defender Race to Gain SYSTEM Privileges
Summary
RoguePlanet is a Windows local privilege escalation PoC that exploits a TOCTOU flaw in Defender’s remediation process to place and run an attacker-controlled executable as SYSTEM. It reportedly works on fully updated Windows 10 and 11 systems.
Key points
- Researcher Chaotic Eclipse released RoguePlanet on June 10, 2026; no CVE had been assigned at publication.
- The exploit reportedly works on Windows 10 and 11 with June 2026 updates, but its current method does not work on Windows Server.
- It triggers Defender to remediate an EICAR test file, then exploits a path-resolution race to redirect Defender’s privileged file operation.
- Oplocks and NTFS junctions help make the race reliable and place the exploit’s executable at the Windows Error Reporting Manager path.
- A built-in Windows Error Reporting scheduled task then launches the planted executable as SYSTEM, which can provide an interactive SYSTEM console.
- The article recommends Sysmon monitoring for suspicious wermgr.exe file creation, the \RoguePlanet named pipe, and SYSTEM-level wermgr.exe-to-conhost.exe activity.
Article Details
- Attack Vectors
- RoguePlanet exploits a TOCTOU race in Windows Defender's threat-remediation file handling, using NTFS junctions to redirect a privileged file write.
- The exploit uses oplocks and a Volume Shadow Copy snapshot to make the race deterministic, then replaces the restored file with its own executable.
- A standard user triggers Defender to scan and remediate an EICAR test file staged as wermgr.exe.
- The planted executable is launched as SYSTEM by the Windows Error Reporting QueueReporting scheduled task, then uses a named pipe and token duplication to open an interactive SYSTEM console.
- Defensive Notes
- Enable Windows process-creation command-line auditing and Sysmon file-create (Event ID 11) and pipe-event (Event ID 17) logging.
- Monitor for wermgr.exe written to suspicious locations, creation of the \RoguePlanet named pipe, and SYSTEM-context execution chains in which wermgr.exe launches conhost.exe and conhost.exe launches cmd.exe.
- Look for named pipe creation under the LOCAL SYSTEM security context when the originating process is associated with a non-SYSTEM user account.
- The article reports that no CVE had been assigned at publication and that RoguePlanet was tested on fully updated Windows 10 and 11 systems with June 2026 updates. It says Windows Server exploitation was not working with the described method, while the researcher claimed the underlying vulnerability still affected server installations.
MITRE ATT&CK
T1055 · Process InjectionThe planted executable duplicates its SYSTEM token, retargets it to the user's session, and launches conhost.exe.T1068 · Exploitation for Privilege EscalationRoguePlanet exploits a Windows Defender TOCTOU vulnerability to elevate from a standard user to SYSTEM.T1546.003 · Windows Management Instrumentation Event SubscriptionThe exploit invokes the Windows Error Reporting QueueReporting scheduled task to launch its planted wermgr.exe as SYSTEM.
People
Vendors
Products
Guardsix SIEMDetection With Guardsix SIEMMicrosoft WindowsOn June 10, 2026, the researcher known as Chaotic Eclipse (also operating under the alias Nightmare Eclipse) released another Windows local privilege escalation PoC, dubbed RoguePlanet.SysmonWindows SysmonWindows DefenderRoguePlanet lands in the Windows Defender corner of that catalogue, next to BlueHammer, RedSun and UnDefend.Windows Error ReportingWindows Defender's own threat-remediation path as the privileged file-write primitive, with Windows Error Reporting as the SYSTEM execution sink.