RoguePlanet Exploits a Windows Zero-Day Through Defender’s Quarantine Pipeline

Summary

RoguePlanet is a local privilege escalation zero-day that abuses the Microsoft Defender quarantine and remediation workflow on Windows. By combining NTFS directory junctions, opportunistic locks, and the Volume Shadow Copy service, a low-privileged user can interfere with Defender’s handling process and force arbitrary code execution as NT AUTHORITY\SYSTEM. The exploit relies on a deterministic I/O saturation method to consistently win timing races during file quarantine operations.

Investigation

The Howler Cell Threat Research Team reproduced the exploit on a fully patched Windows 11 Pro system and confirmed that it achieves SYSTEM-level code execution without memory corruption or administrative access. Their analysis identified a seven-step attack chain involving an embedded ISO image, NTFS reparse points, and abuse of the WER QueueReporting scheduled task. The researchers also noted that small source-level changes allow the exploit to evade static detection with relative ease.

Mitigation

There is currently no official patch addressing the underlying cause of RoguePlanet. Defenders should monitor for creation of the specific named pipes associated with the exploit and for unusual filesystem activity involving UUID-like directory names under %TEMP%. Additional hardening should focus on limiting abuse of NTFS junctions and detecting non-system processes that enumerate Volume Shadow Copies.

Response

If RoguePlanet-related activity is detected, security teams should isolate the affected host and investigate any processes that spawn conhost.exe from SYSTEM-integrity parents into user sessions. Analysts should also hunt for wermgr.exe running from unexpected paths and inspect %TEMP% for the RP_ directory structure. Reviewing Task Scheduler logs for suspicious execution of the QueueReporting task is also essential.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary exploits a vulnerability in a running Windows Service to achieve SYSTEM-level code execution. To facilitate communication between the exploited service and the newly injected thread, the adversary creates a named pipe named \.pipeRoguePlanet. Following the successful elevation, the attacker’s payload forces services.exe to spawn conhost.exe to provide an interactive environment for further command execution. This sequence is designed to mimic the behavior of the RoguePlanet exploit chain.

• Regression Test Script:

  # Simulation of RoguePlanet Named Pipe and Process Anomaly
  # NOTE: This script requires Administrative privileges to simulate service-like behavior
  
  Write-Host "[+] Starting RoguePlanet Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate Named Pipe Creation (matches selection_pipe)
  # We use PowerShell to create a named pipe that mimics the target indicator
  $pipeName = "RoguePlanet"
  $pipe = New-Object System.IO.Pipes.NamedPipeServerStream($pipeName, [System.IO.Pipes.PipeDirection]::InOut)
  Write-Host "[+] Named Pipe \\.\pipe\$pipeName created." -ForegroundColor Green
  
  # 2. Simulate anomalous process spawning (matches selection_conhost and selection_parent)
  # In a real exploit, services.exe would be the parent. 
  # Since we cannot easily 'become' services.exe without a kernel exploit, 
  # we simulate the telemetry by triggering a process creation event that 
  # mimics the specific parent-child relationship expected by the rule logic.
  
  Write-Host "[+] Simulating conhost.exe spawning from services.exe..." -ForegroundColor Cyan
  
  # We use a trick to mimic the telemetry: creating a process that the SIEM/Sysmon 
  # will record with the target parent if we were running in a controlled lab environment.
  # For the purpose of this detection test, we will execute a command that 
  # targets the specific Image/ParentImage criteria.
  
  # Note: In a real-world validation, the researcher would use a tool like 
  # 'ProcMon' or a custom driver to spoof the Parent Process ID (PPID) 
  # of services.exe to ensure the rule triggers accurately.
  
  Start-Process "conhost.exe" -ArgumentList "/c echo Simulation Complete" -WindowStyle Hidden
  
  Write-Host "[+] Simulation commands sent. Check SIEM for alerts." -ForegroundColor Yellow
  
  # Keep pipe open briefly to ensure telemetry is captured
  Start-Sleep -Seconds 5
  $pipe.Dispose()

• Cleanup Commands:

  # Cleanup: Close any lingering pipes and terminate any simulated processes
  Get-Process conhost | Stop-Process -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Green