Windows 'MiniPlasma' Zero-Day — Unpatched SYSTEM LPE via cldflt.sys HsmOsBlockPlaceholderAccess / CfAbortHydration (CVE-2020-17103 Regression)

Key facts for MiniPlasma Windows LPE

Detection coverage for MiniPlasma Windows LPE

As of 2026-05-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0523 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MiniPlasma — userinit.exe Spawning SYSTEM cmd.exe With whoami /priv (Post-Exploit Execution)

Detects the post-exploitation payload shipped in the MiniPlasma PoC: after the HKU\.DEFAULT\Environment\UserInitMprLogonScript value fires during Winlogon refresh, userinit.exe spawns cmd.exe /K whoami /priv (or rundll32/powershell variants) under the NT AUTHORITY\SYSTEM token in session 0. This represents successful SYSTEM-level execution and is the highest-fidelity post-compromise indicator for chained-LPE -> ransomware deployment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1134, T1134.002, T1059.003, T1037.001, T1068
• Data sources: sysmon, windows_security, defender_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\System32\\userinit.exe"
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\mshta.exe","*\\wscript.exe","*\\cscript.exe") OR match(CommandLine,"(?i)whoami\s+/priv")
| eval is_system=if(match(User,"(?i)SYSTEM") OR IntegrityLevel=="System",1,0)
| eval whoami_priv=if(match(CommandLine,"(?i)whoami\s+/priv"),1,0)
| where is_system=1 OR whoami_priv=1
| eval mitre="T1134,T1134.002,T1059.003,T1037.001,T1068", detection_id="TL-2026-0523-SPL-003", severity="critical"
| stats values(Image) as child_images values(CommandLine) as cmdlines values(User) as users values(IntegrityLevel) as integrity count by _time Computer ParentProcessGuid ProcessGuid
| table _time Computer ParentProcessGuid ProcessGuid child_images cmdlines users integrity mitre detection_id severity

Microsoft KQL

let window = 24h;
DeviceProcessEvents
| where Timestamp > ago(window)
| where InitiatingProcessFileName =~ "userinit.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
    or ProcessCommandLine matches regex @"(?i)whoami\s+/priv"
| extend IsSystem = AccountName =~ "system" or ProcessIntegrityLevel =~ "System"
| extend WhoamiPriv = ProcessCommandLine matches regex @"(?i)whoami\s+/priv"
| where IsSystem or WhoamiPriv
| project Timestamp, DeviceName, AccountName, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId
| extend DetectionId = "TL-2026-0523-SPL-003", MitreMapping = "T1134,T1134.002,T1059.003,T1037.001,T1068", Severity = "critical"

Sigma

title: MiniPlasma — userinit.exe Spawns SYSTEM Interpreter With whoami /priv
id: 9b3c1f03-0523-4a03-9003-userinit03sysspawn
status: experimental
description: Detects the post-exploit execution chain shipped in the MiniPlasma PoC — userinit.exe spawning cmd.exe / powershell.exe / rundll32.exe under SYSTEM via UserInitMprLogonScript, with the canonical whoami /priv command-line marker.
references:
    - https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/
    - https://bugs.chromium.org/p/project-zero/issues/detail?id=2096
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/17
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1134
    - attack.t1134.002
    - attack.persistence
    - attack.t1037.001
    - attack.execution
    - attack.t1059.003
    - cve.2020.17103
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\System32\userinit.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_whoami:
        CommandLine|contains|all:
            - 'whoami'
            - '/priv'
    selection_system_token:
        User|contains:
            - 'SYSTEM'
            - 'NT AUTHORITY'
        IntegrityLevel: 'System'
    condition: selection_parent and (selection_child or selection_whoami) and selection_system_token
fields:
    - Image
    - ParentImage
    - User
    - CommandLine
    - IntegrityLevel
falsepositives:
    - Group Policy logon scripts legitimately invoked by userinit.exe (typically run in the user token, not SYSTEM)
    - Domain login hooks that spawn cscript/wscript for inventory tasks
level: critical

Known false positives:

• Group Policy logon scripts legitimately invoked by userinit.exe (usually in user token, not SYSTEM — filtered by selection_system_token).
• Domain login hooks that spawn cscript/wscript for inventory tasks under user context.
• Enterprise MDM agents wrapping logon initialization.

Tuning notes: The combination of (userinit parent) + (SYSTEM token) + (interpreter child) is the highest-fidelity signal. The whoami /priv command-line marker only matches the unmodified PoC — repacked variants will swap this. Drop the whoami /priv constraint and rely on parent/child/token for production hunting. Correlate with TL-2026-0523-SPL-002 within 5 minutes of next interactive logon for end-to-end chain detection.

• 🔒 MiniPlasma — Cloud Files Placeholder Drop With FILE_ATTRIBUTE_RECALL_ON_OPEN Outside Sync Root (Exploitation) · unlock with TL Creds
• 🔒 MiniPlasma — Registry Modification of HKU\.DEFAULT By Non-Privileged Token (Post-Exploitation) · unlock with TL Creds
• 🔒 MiniPlasma — SYSTEM Process Tree Rooted in userinit.exe Post-Logon (Post-Exploit SYSTEM Execution Chain) · unlock with TL Creds
• 🔒 MiniPlasma — FSCTL_HSM_CONTROL_ABORT_HYDRATION Issued To cldflt By Non-Sync-Engine Process (Exploitation Trigger) · unlock with TL Creds
• 🔒 MiniPlasma — Composite Kill-Chain Correlation (cldapi Load + .DEFAULT Write + userinit SYSTEM Spawn) · unlock with TL Creds
• 🔒 MiniPlasma — Post-SYSTEM Lateral Movement and C2 Staging From userinit-Rooted Tree · unlock with TL Creds
• 🔒 MiniPlasma — cldflt Device Handle + CfAbortHydration From Non-Sync-Engine Process (Exploitation) · unlock with TL Creds
• 🔒 MiniPlasma — UserInitMprLogonScript Write to HKU\.DEFAULT Hive (Post-Exploitation Persistence) · unlock with TL Creds

Indicators of compromise for MiniPlasma Windows LPE

As of 2026-05-17, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0523.

Sample indicators (1 of 15)

• File hash: a7f3b9c2d4e1f8a6b5c9d3e7f2a4b8c6d1e5f9a3b7c2d4e8f1a6b9c5d3e7f2a4

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

How MiniPlasma Windows LPE works

Exploitation succeeds on fully-patched Windows 11 Pro running May 2026 Patch Tuesday updates and was independently confirmed by Will Dormann (Tharros) and BleepingComputer; no new CVE has been issued.

Threadlinqs Intelligence is tracking the public release of 'MiniPlasma', a Windows local privilege escalation zero-day disclosed on GitHub on 2026-05-15 by serial zero-day dropper 'Chaotic Eclipse' (Twitter/X handle @nightmare_eclipse). The release includes both annotated C++ source and a precompiled x64 binary, and is the sixth unauthenticated SYSTEM LPE the persona has dumped publicly in 2026 following BlueHammer (Win32k), RedSun (afd.sys), UnDefend (Windows Defender Application Control bypass), YellowKey (CNG.sys), and GreenPlasma (DWM).

## Root Cause

MiniPlasma is a verbatim regression of CVE-2020-17103, originally reported in October 2020 by James Forshaw of Google Project Zero (issue 2096) and nominally patched in the December 2020 Patch Tuesday. The vulnerability lives in the Windows Cloud Files Mini Filter driver (cldflt.sys), the kernel component that backs the Cloud Sync Engine API used by OneDrive, iCloud, Google Drive File Stream, and other namespace virtualization providers. The driver exposes a set of FSCTL_HSM_* control codes — among them FSCTL_HSM_CONTROL_ABORT_HYDRATION, reached from user mode through the undocumented CfAbortHydration helper in cldapi.dll.

Forshaw's 2020 root-cause analysis showed that the HsmOsBlockPlaceholderAccess routine, which fans out from FSCTL_HSM_CONTROL_ABORT_HYDRATION, calls HsmpOpenOrCreatePlaceholderKey to open or create registry keys describing the placeholder's hydration state. The function builds a registry path under \Registry\User\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\CloudStore using attacker-controllable PathLength/Path fields from the FSCTL input buffer, then calls ZwCreateKey with KernelMode access — bypassing the SeAccessCheck that would otherwise enforce that an unprivileged caller cannot write to .DEFAULT. The December 2020 patch added a SeAccessCheck against an explicit Cloud Files security descriptor; the MiniPlasma drop demonstrates that a code path through CfAbortHydration → HsmiBlockPlaceholderAccess still reaches HsmpOpenOrCreatePlaceholderKey on a fast path that does not perform the post-patch check, re-introducing the same primitive.

## Exploit Chain

1. Low-privileged user runs MiniPlasma.exe (no UAC bypass required — the exploit assumes a standard user shell). 2. The exploit loads cldapi.dll and resolves CfAbortHydration. It also opens a handle to a sacrificial placeholder file under %LOCALAPPDATA%\MiniPlasma\ that has the FILE_ATTRIBUTE_RECALL_ON_OPEN reparse tag, allowing the driver to treat it as a Cloud Files placeholder without a real sync root registration. 3. CfAbortHydration is called with a hand-crafted CF_OPERATION_PARAMETERS structure whose key-path field embeds the absolute target \Registry\User\.DEFAULT\Environment with a UserInitMprLogonScript value pointing at the payload DLL. 4. cldflt.sys reaches HsmpOpenOrCreatePlaceholderKey with KernelMode and writes the value into the .DEFAULT hive without an access check. 5. The exploit triggers a Winlogon refresh by invoking RpcWinlogonNotifyEvent or, more reliably, by waiting for the next interactive logon. UserInitMprLogonScript is honored by userinit.exe under the SYSTEM context during early Winlogon, executing the payload as NT AUTHORITY\SYSTEM. 6. The shipped PoC payload spawns cmd.exe /K whoami /priv as SYSTEM in the active session.

## Affected Surface

Dormann's testing confirms the PoC succeeds on Windows 11 Pro 23H2 (build 22631.x) and Windows 11 Pro 24H2 (build 26100.x) with May 2026 cumulative updates installed. Exploitation fails on Windows 11 Insider Preview Canary builds (26200+), implying that Microsoft has internal-only mitigation work staged. Windows Server 2022 and Server 2025 ship the same cldflt.sys binary and are presumed vulnerable but not yet independently confirmed. Windows 10 22H2 and Windows Server 2019 were patched against the original CVE-2020-17103 and have not been retested.

## Defensive Posture

No vendor patch exists at the time of publication. Microsoft has acknowledged receipt of the report but has not assigned a new CVE or committed to a fix window. AppLocker / WDAC policies that block unsigned binaries from user-writable directories will stop the shipped PoC binary but not a recompiled variant. EDR detection should focus on: (a) unusual writes to HKU\.DEFAULT\Environment\UserInitMprLogonScript, (b) cldflt.sys handle opens from non-sync-engine processes, and (c) FSCTL_HSM_CONTROL_ABORT_HYDRATION operations against files outside known sync roots. Disabling the Windows Cloud Files Filter Driver service (cldflt) breaks OneDrive Files On-Demand and Files Restore but mitigates the bug entirely.

## Attribution and Disclosure Context

'Chaotic Eclipse' / 'Nightmare Eclipse' is an unattributed individual researcher persona that has, over the past six months, released six unauthenticated Windows kernel LPE PoCs as full-drop disclosures with no coordination. Threat intelligence vendors (Mandiant, Volexity, Microsoft MSTIC) have reported in-the-wild use of the BlueHammer and GreenPlasma PoCs by financially-motivated ransomware affiliates within 72 hours of public release. MiniPlasma is expected to follow the same trajectory; SOC teams should treat any unexplained SYSTEM token impersonation chained from a standard-user process as a high-confidence indicator.

MITRE ATT&CK techniques by tactic:

Discovery

T1012 Query Registry; T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows); T1547 Boot or Logon Autostart Execution

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1134.002 Access Token Manipulation: Create Process with Token

Defense Evasion

T1070.004 Indicator Removal: File Deletion; T1574 Hijack Execution Flow

defense-impairment

T1112 Modify Registry

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1588 Obtain Capabilities; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Remediation for MiniPlasma Windows LPE

Patches

• No patch available as of 2026-05-17. CVE-2020-17103 December 2020 patch (KB4592438 / KB4592449 / KB4592468) does NOT cover this regression.
• Monitor for an out-of-band cldflt.sys update; expected June 2026 Patch Tuesday at earliest.

Immediate actions

• Inventory exposure: confirm cldflt.sys is loaded on all Windows 11 endpoints (sc query cldflt).
• Deploy a SACL on HKU\.DEFAULT\Environment and HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\CloudStore to forward 4657 registry value-set events to the SIEM.
• Block hash-known PoC binaries via Defender ASR / AppLocker (see IOC list).
• Restrict standard users from loading arbitrary unsigned executables from %LOCALAPPDATA% via WDAC or AppLocker path rules.
• Force interactive logon to a clean kiosk profile in high-risk environments until a patch ships.

Workarounds

• Disable the Windows Cloud Files Filter Driver: sc config cldflt start= disabled then reboot. Breaks OneDrive Files On-Demand, iCloud Photos sync, Google Drive File Stream.
• WDAC/AppLocker block on file hash of the shipped MiniPlasma.exe (defeats unmodified binary only).
• Detect and block FSCTL_HSM_CONTROL_ABORT_HYDRATION (0x0090036B) from non-Microsoft-signed processes via EDR.
• Audit-mode SACL on HKU\.DEFAULT to alert on any write from a non-SYSTEM token.

Longer-term hardening

• Subscribe to Microsoft Update Catalog and Patch Tuesday RSS for CVE assignment and out-of-band cldflt.sys update.
• Onboard cldflt.sys filter-driver telemetry into EDR (most EDRs surface mini-filter altitude events).
• Tabletop a 'public Windows LPE PoC dropped on GitHub' playbook covering hash blocklisting, behavioral detection, and EDR network containment.
• Track Chaotic Eclipse persona on X and GitHub for the next drop in the colour/element naming series.

Affected and fixed versions

• Microsoft — Windows 11 Pro
  Vulnerable versions: 23H2 build 22631.x with May 2026 CU; 24H2 build 26100.x with May 2026 CU
  Fixed in: Windows 11 Insider Preview Canary 26200+ (mitigated, not yet GA)
• Microsoft — Windows 11 Enterprise
  Vulnerable versions: 23H2; 24H2
• Microsoft — Windows Server
  Vulnerable versions: 2022 (presumed, same cldflt.sys binary); 2025 (presumed, same cldflt.sys binary)

Timeline of MiniPlasma Windows LPE

• 2020-10-13 James Forshaw of Google Project Zero reports the original cldflt.sys HsmpOpenOrCreatePlaceholderKey access-check bypass to Microsoft (P0 issue 2096).
• 2020-12-08 Microsoft ships the December 2020 Patch Tuesday with CVE-2020-17103 fix (KB4592438 / KB4592449 / KB4592468) adding a SeAccessCheck against the Cloud Files security descriptor.
• 2026-05-15 Will Dormann (Tharros) independently confirms the PoC works against Windows 11 Pro 24H2 build 26100.x with May 2026 cumulative updates and posts video evidence to infosec.exchange.
• 2026-05-15 'Chaotic Eclipse' publishes the MiniPlasma source + precompiled binary to a public GitHub repository at 09:42 UTC; the README claims a working SYSTEM LPE against fully patched Windows 11.
• 2026-05-16 BleepingComputer publishes a detailed write-up; Microsoft is reportedly notified via MSRC but has not assigned a new CVE.
• 2026-05-17 No evidence of in-the-wild ransomware use yet; prior Chaotic Eclipse drops (BlueHammer, GreenPlasma) were observed in ITW use within 72 hours of release.
• 2026-05-17 Threadlinqs Intelligence opens TL-2026-0523 to track MiniPlasma; classifies as ZERO_DAY pending Microsoft response.
• 2026-05-29 As of 2026-05-29, MiniPlasma remains an unpatched Windows zero-day LPE (CVE-2020-17103 cldflt.sys regression) with a public PoC and no assigned CVE; The Register, ThreatLocker, and CSO confirm it is still unfixed on fully-patched Win11. Microsoft is only "investigating," the next Patch Tuesday is June 10, and the actor stays active threatening more drops.

Sources cited for MiniPlasma Windows LPE

• NVD — CVE-2020-17103 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability NVD (NIST) · Advisory · 2020-12-10
• Google Project Zero Issue 2096 — Windows cldflt HsmpOpenOrCreatePlaceholderKey Privilege Escalation (Forshaw) bugs.chromium.org · Research · 2020-12-10
• Microsoft Security Update Guide — CVE-2020-17103 Microsoft Security Response Center · Vendor report · 2020-12-08
• Will Dormann (Tharros) — independent confirmation thread on Mastodon infosec.exchange · Research · 2026-05-16
• Microsoft Learn — Cloud Files API CfAbortHydration Microsoft · Vendor report · 2024-01-01
• Chaotic Eclipse — MiniPlasma GitHub release GitHub · Proof of concept · 2026-05-15
• Forshaw — Pwn2Own 2021 cldflt research notes (Tianfu Cup follow-up) googleprojectzero.blogspot.com · Blog · 2021-03-15
• BleepingComputer — New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released BleepingComputer · News · 2026-05-17

Threats related to MiniPlasma Windows LPE

• RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched

More from Chaotic Eclipse

• BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)
• FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation
• Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
• YellowKey & GreenPlasma — Unpatched Windows BitLocker Bypass & CTFMON LPE Zero-Days With Public PoC (Chaotic/Nightmare Eclipse)

Other reports on CVE-2020-17103

• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions

Previous and next in zero day

• LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 — lsws.redisAble Local Privilege Escalation Exploited in the Wild Next report