Cyber Security News Aggregator
.Cyber Tzar
provide acyber security risk management
platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.
First slide label
Some representative placeholder content for the first slide.
Second slide label
Some representative placeholder content for the second slide.
Third slide label
Some representative placeholder content for the third slide.
UnDefend: Chaotic Eclipse's third Defender zero-day blocks all signature updates from a standard user — no admin required
published on 2026-04-17 17:08:04 UTC by /u/TakesThisSeriouslyContent:
Most coverage is calling this a DoS. The code is more structured.
Four independent locking mechanisms — ReadDirectoryChangesW watches the Definition Updates staging dir, FILE_SHARE_WRITE but no FILE_SHARE_READ means Windows Update can keep writing but MsMpEng.exe gets STATUS_SHARING_VIOLATION on every load attempt. The backup files are exclusively locked before the main attack even starts. Service-stop hook via NotifyServiceStatusChangeW covers the engine restart path. MRTWorkerThread covers the Malicious Software Removal Tool separately.
The README mentions a fifth mechanism — lying to the EDR console via MSFT_MpComputerStatus — that the author explicitly withheld. Without it: noisy update errors. With it: silent indefinite detection window.
BlueHammer patched Tuesday. RedSun unpatched. UnDefend has no CVE.
[link] [comments]
https://www.reddit.com/r/netsec/comments/1so72tn/undefend_chaotic_eclipses_third_defender_zeroday/
Published: 2026 04 17 17:08:04
Received: 2026 04 17 17:17:59
Feed: /r/netsec - Information Security News and Discussion
Source: /r/netsec - Information Security News and Discussion
Category: Cyber Security
Topic: Cyber Security
Views: 3
