Mitigations for ShieldCrash

 

Immediate Mitigations

1. Restrict Local Code Execution

ShieldCrash is reported as a local privilege escalation technique, meaning an attacker typically needs code execution on the endpoint first. Preventing unauthorized code execution significantly reduces risk.

Recommended controls:

• Windows Defender Application Control (WDAC)
• AppLocker
• Software Restriction Policies
• Remove local administrator rights where possible
• Block execution from:
  • %TEMP%
  • %APPDATA%
  • Downloads folders
  • User-writable directories

2. Harden Defender Tamper Protection

Although the published PoC reportedly demonstrates file read rather than file write capabilities, keeping Defender hardened reduces opportunities for follow-on attacks.

Verify:

• Tamper Protection = Enabled
• Cloud-delivered protection = Enabled
• Automatic sample submission = Enabled
• Defender Engine and Platform versions are current

3. Enable Attack Surface Reduction (ASR) Rules

If you're running Microsoft Defender for Endpoint, ensure critical ASR rules are enabled, especially those that block:

• Credential theft from LSASS
• Office child process creation
• Script abuse
• Obfuscated PowerShell
• Unsigned executable downloads

These controls help stop the initial foothold that ShieldCrash reportedly requires.

---

Monitoring and Detection

Watch for SYSTEM-Level Reads

The reports indicate that the current PoC performs arbitrary file reads as SYSTEM. Monitoring access to sensitive files may provide detection opportunities.

Pay attention to access involving:

• SAM
• SECURITY hive
• SYSTEM hive
• NTDS.dit
• LSASS-related artifacts
• Defender configuration files

Hunt for Abnormal Defender Activity

Look for:

• Unusual MsMpEng.exe activity
• Defender processes accessing unexpected files
• Large numbers of file read operations initiated by Defender-related processes
• Defender interacting with user-writable locations

Microsoft Defender XDR Hunting

Potential hunting focus:

DeviceProcessEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| summarize count() by DeviceName, FileName, bin(Timestamp, 1h)

And:

DeviceFileEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FolderPath contains "Users"

Review results for anomalous behavior.

---

Administrative Controls

Reduce Local Attack Surface

• Remove unnecessary interactive logons.
• Restrict RDP access.
• Enforce MFA everywhere.
• Use Privileged Access Workstations for administrators.
• Audit local admin memberships.

Since ShieldCrash reportedly requires local execution, reducing the ability to land on a workstation is critical.

Segment High-Value Systems

Until Microsoft issues a fix:

• Increase monitoring on domain controllers.
• Isolate Tier-0 assets.
• Limit administrator sign-ins on workstations.
• Review Defender deployments on critical servers.