One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed

Nightmare-Eclipse publicly released ShieldCrash, a Windows Defender privilege-escalation bypass PoC that the authors describe as an incomplete "skeleton"; testing showed it consistently returns ntdll.dll rather than the requested target, but leaves reproducible staging artifacts (ShieldCrash_<GUID> folders, object-manager mounts to \BaseNamedObjects\Restricted, and symbolic links) and triggers Defender engine activity. The report documents telemetry from multiple EDRs, describes environment- and patch-dependent behaviors, and recommends focusing detections on the mount-and-symlink object-manager pattern and cross-directory staging rather than ephemeral strings or filenames.