EIP-2026-115792

This C# PoC demonstrates a bypass of Windows Defender's Controlled Folder Access feature by using a local UNC admin share path (e.g., \\localhost\c$\...) to delete a protected file, circumventing the blacklist-based protection.