Attack Chain

1. An attacker gains initial local access to a vulnerable Windows system, typically through other means (e.g., social engineering, exploiting a user-level application vulnerability).
2. The attacker executes a malicious process that leverages Windows API calls like OpenVirtualDisk and AttachVirtualDisk to mount a fake ISO image.
3. The malicious process elevates its own or specific thread priorities to REALTIME_PRIORITY_CLASS and THREAD_PRIORITY_TIME_CRITICAL to enhance its ability to win race conditions.
4. The attacker initiates operations designed to trigger a race condition between Windows Defender's MpCleanCallbackFunction (cleanup routine) and the system's Volume Shadow Copy creation.
5. During the race, the attacker manipulates file system operations to substitute or plant malicious files in a location Defender is processing for cleanup.
6. The vulnerability allows the malicious process to execute code or manipulate system services using CreateProcessAsUser with NT AUTHORITY\SYSTEM privileges.
7. The system process MsMpEng.exe experiences a use-after-free condition and crashes, leaving the system temporarily without active antivirus protection.
8. The attacker maintains NT AUTHORITY\SYSTEM privileges, enabling full control over the compromised system, persistence, and further malicious activities without AV detection.

Impact

A successful exploitation of this race condition results in an attacker achieving NT AUTHORITY\SYSTEM privileges on the compromised Windows host. This complete control allows for arbitrary code execution, data exfiltration, deployment of further malware, and establishment of persistence. Additionally, the exploit can cause the MsMpEng.exe process to crash due to a use-after-free condition, temporarily disabling Windows Defender's real-time protection and leaving the system vulnerable to subsequent attacks without immediate antivirus safeguards.

Recommendation

• Apply the official Microsoft security update as soon as it becomes available to patch the race condition vulnerability (EDB-52612) in Windows Defender (MsMpEng.exe).
• Implement advanced API monitoring on endpoints for suspicious calls to OpenVirtualDisk or AttachVirtualDisk from non-system processes, particularly when observed alongside rapid process priority changes, to potentially identify exploitation attempts.
• Focus endpoint detection on CreateProcessAsUser calls where the resulting process runs as NT AUTHORITY\SYSTEM but is spawned by an unusual parent process or exhibits suspicious command-line arguments.
• Configure monitoring for crashes of MsMpEng.exe (e.g., via event logs) that are not attributed to legitimate system reconfigurations or updates, as this could indicate a successful use-after-free exploitation.