Will Dormann

Reported Context (9)

Vulnerability analyst who confirmed the ShieldBreak exploit works and noted that Microsoft Defender must be enabled for privilege escalation. Microsoft Developing Patch for Defender ShieldBreak Zero-Day
A vulnerability analyst explained how the exploit could modify the classes registry hive and enable code execution when an admin account logs in. Microsoft Patches LegacyHive Windows Zero-Day
Vulnerability analyst who warned about similar Plug and Play installation risks and recommended the DisableCoInstallers setting. Plug and Pwn Attacks Abuse Windows PnP and RDP USB Redirection for SYSTEM Access
Principal vulnerability analyst at Tharros who confirmed the exploit works and that Microsoft Defender must be enabled for it to escalate privileges. ShieldBreak Exploit Reportedly Bypasses Patched Defender Flaw to Gain SYSTEM Privileges
Tharros principal vulnerability analyst who analyzed the proof of concept and described how non-admin users could modify the classes registry hive and trigger code execution at administrator login. LegacyHive Windows Zero-Day Gets Free Unofficial 0Patch Micropatches

CVE (6)

People (9)

MITRE ATT&CK (10)

Vendors (7)

Products (12)

Tools (9)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.