Microsoft Malware Protection Engine Elevation of Privilege via Improper Link Resolution (RoguePlanet)

#Requires -Version 5.1
<#
.SYNOPSIS
    Check-CVE202650656.ps1 — Detect exposure to CVE-2026-50656 (RoguePlanet / ShieldBreak)
.DESCRIPTION
    Checks Microsoft Defender Malware Protection Engine status and version,
    determines vulnerability to both the original RoguePlanet vector and the
    ShieldBreak patch bypass (CVE-2026-69414).
    Output: VULNERABLE / PATCHED / UNKNOWN
    Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$result = 'UNKNOWN'
$details = @()

# Check if Defender service is running
$defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
if (-not $defenderService -or $defenderService.Status -ne 'Running') {
    $details += 'Microsoft Defender service (WinDefend) is not running.'
    # Check if MsMpEng.exe is present at all
    $mpEng = Get-Process -Name MsMpEng -ErrorAction SilentlyContinue
    if (-not $mpEng) {
        $details += 'MsMpEng.exe not found in running processes.'
        $details += 'System may use a third-party AV — Defender engine not active.'
        $result = 'UNKNOWN'
        Write-Host "[*] $($details -join ' ')" -ForegroundColor Yellow
        Write-Host "[$result] Cannot determine vulnerability — Defender not active." -ForegroundColor Yellow
        exit 2
    }
}

# Get Defender engine version via Get-MpComputerStatus
try {
    $mpStatus = Get-MpComputerStatus -ErrorAction Stop
    $engineVersion = $mpStatus.AMEngineVersion
    $platformVersion = $mpStatus.AMServiceVersion
    $rtpEnabled = $mpStatus.RealTimeProtectionEnabled
    $details += "Engine version: $engineVersion"
    $details += "Platform version: $platformVersion"
    $details += "Real-Time Protection: $rtpEnabled"
} catch {
    $details += 'Unable to query Get-MpComputerStatus (may require elevation).'
    # Fallback: check registry
    $regPath = 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Signature Updates'
    $regEngine = (Get-ItemProperty -Path $regPath -Name 'EngineVersion' -ErrorAction SilentlyContinue).EngineVersion
    if ($regEngine) {
        $engineVersion = $regEngine
        $details += "Engine version (registry): $engineVersion"
    } else {
        $details += 'Cannot determine engine version.'
        Write-Host "[*] $($details -join ' | ')" -ForegroundColor Yellow
        Write-Host "[UNKNOWN] Cannot determine Defender engine version." -ForegroundColor Yellow
        exit 2
    }
}

# Parse engine version for RoguePlanet patch check
$patchedEngine = [version]'1.1.26060.3008'
try {
    $currentEngine = [version]$engineVersion
    $roguePlanetPatched = $currentEngine -ge $patchedEngine
} catch {
    $roguePlanetPatched = $false
    $details += 'WARNING: Could not parse engine version for comparison.'
}

# Check for ShieldBreak mitigation: phoneinfo.dll placeholder
$phoneInfoPath = "$env:SystemRoot\System32\phoneinfo.dll"
$shieldBreakMitigated = $false
if (Test-Path $phoneInfoPath) {
    $fileInfo = Get-Item $phoneInfoPath -ErrorAction SilentlyContinue
    if ($fileInfo.Length -eq 0) {
        $shieldBreakMitigated = $true
        $details += 'ShieldBreak mitigation: 0-byte phoneinfo.dll placeholder FOUND.'
    } else {
        # Check if it is the legitimate Microsoft-signed phoneinfo.dll
        $sig = Get-AuthenticodeSignature $phoneInfoPath -ErrorAction SilentlyContinue
        if ($sig -and $sig.Status -eq 'Valid' -and $sig.SignerCertificate.Subject -like '*Microsoft*') {
            $details += "phoneinfo.dll present (legitimate, $($fileInfo.Length) bytes, Microsoft-signed). ShieldBreak mitigation NOT applied."
        } else {
            $details += "WARNING: phoneinfo.dll present ($($fileInfo.Length) bytes) but NOT Microsoft-signed — possible compromise indicator!"
        }
    }
} else {
    $details += 'phoneinfo.dll not present in System32. ShieldBreak mitigation NOT applied.'
}

# Determine overall status
if (-not $roguePlanetPatched) {
    $result = 'VULNERABLE'
    $details += 'VULNERABLE to BOTH RoguePlanet (original) AND ShieldBreak (bypass). Engine below v1.1.26060.3008.'
} elseif ($roguePlanetPatched -and -not $shieldBreakMitigated) {
    $result = 'VULNERABLE'
    $details += 'RoguePlanet (original) patched, but VULNERABLE to ShieldBreak bypass (CVE-2026-69414). No vendor fix available.'
} elseif ($roguePlanetPatched -and $shieldBreakMitigated) {
    $result = 'PATCHED'
    $details += 'RoguePlanet patched (engine updated) and ShieldBreak mitigated (phoneinfo.dll placeholder). Note: ShieldBreak mitigation is a workaround, not a vendor fix.'
}

# Output
$color = switch ($result) {
    'VULNERABLE' { 'Red' }
    'PATCHED'    { 'Green' }
    default      { 'Yellow' }
}

Write-Host ''
Write-Host '=== CVE-2026-50656 (RoguePlanet / ShieldBreak) Check ===' -ForegroundColor Cyan
foreach ($d in $details) {
    Write-Host "  [*] $d" -ForegroundColor Gray
}
Write-Host ''
Write-Host "[$result] CVE-2026-50656" -ForegroundColor $color
Write-Host ''

# Exit code
switch ($result) {
    'VULNERABLE' { exit 1 }
    'PATCHED'    { exit 0 }
    default      { exit 2 }
}