Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking

LevelBlue/THOR analyzed ShieldBreak, a public PoC from the Nightmare-Eclipse actor that achieves local privilege escalation on fully patched Windows systems by abusing Cloud Files, NT Object Manager symbolic links, direct MpClient.dll Defender APIs, and a timing race during Defender remediation to plant a DLL in System32 and trigger SYSTEM execution via the Windows Error Reporting QueueReporting task; the report reconstructs the 7-stage chain, lists high-confidence IOCs (notably phoneinfo.dll and the SHIELDBREAK pipe), and provides detection and hunting recommendations.