RoguePlanet PoC Drops: Another Defender Race Condition, Another Path to SYSTEM
An anonymous researcher publishing as Chaotic Eclipse dropped a proof-of-concept against Microsoft Defender that wins SYSTEM on fully patched Windows — when the race goes their way.
Another week, another Defender zero-day with a flair name.
A researcher posting under the handle Chaotic Eclipse — also seen as Nightmare-Eclipse, and now operating a fresh GitHub account called MSNightmare — has released proof-of-concept code for a local privilege escalation in Microsoft Defender. They are calling it RoguePlanet. The exploit reportedly lands SYSTEM on up-to-date Windows installations.
The catch: it is a race condition. "The exploit is a race condition, so it's a hit or miss," the researcher wrote, while claiming a 100% success rate on their own test rig.
Race conditions are one of the oldest tricks in the local-privesc playbook. The pattern is familiar to anyone who has read a TOCTOU writeup from the past two decades. A privileged process checks something, then acts on it, and an unprivileged process slips a swap in between those two moments. The novelty here is the target — Defender's MsMpEng-adjacent surface area has been picked at repeatedly — not the primitive.
This is the same researcher who has been posting a steady drip of Defender PoCs under similarly themed names. Each release follows the pattern: a GitHub repo, a short readme, a video, and minimal coordination with Microsoft. Whether you call that responsible disclosure depends on your priors. What it is not, at least in the strict sense, is exploitation in the wild. There is no public reporting of RoguePlanet being used by an actual threat actor as of publication.
That said, public PoCs for local SYSTEM escalations get folded into commodity toolkits quickly. Initial-access brokers love a reliable LPE, and "hit or miss" stops mattering when you can re-run the binary in a loop until the race tips your way. Anyone who has watched a PrintNightmare-style chain mature from gimmick to standard post-exploitation step knows the trajectory.
A few defensive notes worth flagging:
- Tamper Protection and attack surface reduction rules will not save you from a Defender component being the attack surface itself.
- EDR telemetry from Defender against an exploit targeting Defender is a conflict of interest worth thinking about in your detection engineering.
Microsoft has not yet issued a CVE or advisory for RoguePlanet at time of writing. When one appears it will be tracked through the MSRC update guide. Defenders watching for movement should monitor Defender platform version bumps rather than waiting for a Patch Tuesday bulletin — historically these get fixed in the engine and signed quietly, not in the monthly cumulative.
If you run Windows endpoints, which is to say if you run endpoints, assume a working local SYSTEM primitive is now sitting in a public repo with a catchy name. Plan accordingly.
The race is to the patch, not the swift.
