RoguePlanet and GreatXML expose new Windows privilege escalation and BitLocker bypass techniques
LevelBlue SpiderLabs revealed RoguePlanet, a local privilege escalation that hijacks Microsoft Defender to run attacker code as SYSTEM without kernel exploits, and GreatXML, which manipulates the Windows Recovery Environment to maintain access to BitLocker‑protected data. Both rely on legitimate component interactions, highlighting the need for behavior‑based detections.