# Windows 'MiniPlasma' Zero-Day — Unpatched SYSTEM LPE via cldflt.sys HsmOsBlockPlaceholderAccess / CfAbortHydration (CVE-2020-17103 Regression)

> Independent researcher 'Chaotic Eclipse' (aka Nightmare Eclipse) publicly released a working source-and-binary PoC on GitHub for an unpatched Windows local privilege escalation zero-day dubbed 'MiniPlasma'. The flaw is a regression of CVE-2020-17103 in the Cloud Filter Mini-Filter driver (cldflt.sys): the undocumented CfAbortHydration API path through HsmOsBlockPlaceholderAccess skips access checks and writes attacker-controlled keys into the HKEY_USERS\.DEFAULT hive, yielding NT AUTHORITY\SYSTEM. Exploitation succeeds on fully-patched Windows 11 Pro running May 2026 Patch Tuesday updates and was independently confirmed by Will Dormann (Tharros) and BleepingComputer; no new CVE has been issued.

- **Published:** 2026-05-17T12:00:00Z
- **Last reviewed:** 2026-05-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0523
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-miniplasma-windows-lpe-tl-2026-0523.webp?v=3b155efe (Threadlinqs threat intel: CVE-2020-17103 MiniPlasma Windows LPE: Detection & IOCs (TL-2026-0523) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0523
- **Severity:** HIGH (CVSS 7.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Actor:** Chaotic Eclipse
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (1 shown free below)
- **CVEs:** CVE-2020-17103

## Description

Threadlinqs Intelligence is tracking the public release of 'MiniPlasma', a Windows local privilege escalation zero-day disclosed on GitHub on 2026-05-15 by serial zero-day dropper 'Chaotic Eclipse' (Twitter/X handle @nightmare_eclipse). The release includes both annotated C++ source and a precompiled x64 binary, and is the sixth unauthenticated SYSTEM LPE the persona has dumped publicly in 2026 following BlueHammer (Win32k), RedSun (afd.sys), UnDefend (Windows Defender Application Control bypass), YellowKey (CNG.sys), and GreenPlasma (DWM).

## Root Cause

MiniPlasma is a verbatim regression of CVE-2020-17103, originally reported in October 2020 by James Forshaw of Google Project Zero (issue 2096) and nominally patched in the December 2020 Patch Tuesday. The vulnerability lives in the Windows Cloud Files Mini Filter driver (cldflt.sys), the kernel component that backs the Cloud Sync Engine API used by OneDrive, iCloud, Google Drive File Stream, and other namespace virtualization providers. The driver exposes a set of FSCTL_HSM_* control codes — among them FSCTL_HSM_CONTROL_ABORT_HYDRATION, reached from user mode through the undocumented CfAbortHydration helper in cldapi.dll.

Forshaw's 2020 root-cause analysis showed that the HsmOsBlockPlaceholderAccess routine, which fans out from FSCTL_HSM_CONTROL_ABORT_HYDRATION, calls HsmpOpenOrCreatePlaceholderKey to open or create registry keys describing the placeholder's hydration state. The function builds a registry path under \Registry\User\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\CloudStore using attacker-controllable PathLength/Path fields from the FSCTL input buffer, then calls ZwCreateKey with KernelMode access — bypassing the SeAccessCheck that would otherwise enforce that an unprivileged caller cannot write to .DEFAULT. The December 2020 patch added a SeAccessCheck against an explicit Cloud Files security descriptor; the MiniPlasma drop demonstrates that a code path through CfAbortHydration → HsmiBlockPlaceholderAccess still reaches HsmpOpenOrCreatePlaceholderKey on a fast path that does not perform the post-patch check, re-introducing the same primitive.

## Exploit Chain

1. Low-privileged user runs MiniPlasma.exe (no UAC bypass required — the exploit assumes a standard user shell).
2. The exploit loads cldapi.dll and resolves CfAbortHydration. It also opens a handle to a sacrificial placeholder file under %LOCALAPPDATA%\MiniPlasma\ that has the FILE_ATTRIBUTE_RECALL_ON_OPEN reparse tag, allowing the driver to treat it as a Cloud Files placeholder without a real sync root registration.
3. CfAbortHydration is called with a hand-crafted CF_OPERATION_PARAMETERS structure whose key-path field embeds the absolute target \Registry\User\.DEFAULT\Environment with a UserInitMprLogonScript value pointing at the payload DLL.
4. cldflt.sys reaches HsmpOpenOrCreatePlaceholderKey with KernelMode and writes the value into the .DEFAULT hive without an access check.
5. The exploit triggers a Winlogon refresh by invoking RpcWinlogonNotifyEvent or, more reliably, by waiting for the next interactive logon. UserInitMprLogonScript is honored by userinit.exe under the SYSTEM context during early Winlogon, executing the payload as NT AUTHORITY\SYSTEM.
6. The shipped PoC payload spawns cmd.exe /K whoami /priv as SYSTEM in the active session.

## Affected Surface

Dormann's testing confirms the PoC succeeds on Windows 11 Pro 23H2 (build 22631.x) and Windows 11 Pro 24H2 (build 26100.x) with May 2026 cumulative updates installed. Exploitation fails on Windows 11 Insider Preview Canary builds (26200+), implying that Microsoft has internal-only mitigation work staged. Windows Server 2022 and Server 2025 ship the same cldflt.sys binary and are presumed vulnerable but not yet independently confirmed. Windows 10 22H2 and Windows Server 2019 were patched against the original CVE-2020-17103 and have not been retested.

## Defensive Posture

No vendor patch exists at the time of publication. Microsoft has acknowledged receipt of the report but has not assigned a new CVE or committed to a fix window. AppLocker / WDAC policies that block unsigned binaries from user-writable directories will stop the shipped PoC binary but not a recompiled variant. EDR detection should focus on: (a) unusual writes to HKU\.DEFAULT\Environment\UserInitMprLogonScript, (b) cldflt.sys handle opens from non-sync-engine processes, and (c) FSCTL_HSM_CONTROL_ABORT_HYDRATION operations against files outside known sync roots. Disabling the Windows Cloud Files Filter Driver service (cldflt) breaks OneDrive Files On-Demand and Files Restore but mitigates the bug entirely.

## Attribution and Disclosure Context

'Chaotic Eclipse' / 'Nightmare Eclipse' is an unattributed individual researcher persona that has, over the past six months, released six unauthenticated Windows kernel LPE PoCs as full-drop disclosures with no coordination. Threat intelligence vendors (Mandiant, Volexity, Microsoft MSTIC) have reported in-the-wild use of the BlueHammer and GreenPlasma PoCs by financially-motivated ransomware affiliates within 72 hours of public release. MiniPlasma is expected to follow the same trajectory; SOC teams should treat any unexplained SYSTEM token impersonation chained from a standard-user process as a high-confidence indicator.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1106 Native API
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1547 Boot or Logon Autostart Execution
- T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1134.002 Access Token Manipulation: Create Process with Token
- T1112 Modify Registry
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1070.004 Indicator Removal: File Deletion
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1012 Query Registry

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MiniPlasma — userinit.exe Spawning SYSTEM cmd.exe With whoami /priv (Post-Exploit Execution)** (`TL-2026-0523-SPL-003`)

Detects the post-exploitation payload shipped in the MiniPlasma PoC: after the HKU\.DEFAULT\Environment\UserInitMprLogonScript value fires during Winlogon refresh, userinit.exe spawns cmd.exe /K whoami /priv (or rundll32/powershell variants) under the NT AUTHORITY\SYSTEM token in session 0. This represents successful SYSTEM-level execution and is the highest-fidelity post-compromise indicator for chained-LPE -> ransomware deployment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1134, T1134.002, T1059.003, T1037.001, T1068
- **Data sources:** sysmon, windows_security, defender_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\System32\\userinit.exe"
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\mshta.exe","*\\wscript.exe","*\\cscript.exe") OR match(CommandLine,"(?i)whoami\s+/priv")
| eval is_system=if(match(User,"(?i)SYSTEM") OR IntegrityLevel=="System",1,0)
| eval whoami_priv=if(match(CommandLine,"(?i)whoami\s+/priv"),1,0)
| where is_system=1 OR whoami_priv=1
| eval mitre="T1134,T1134.002,T1059.003,T1037.001,T1068", detection_id="TL-2026-0523-SPL-003", severity="critical"
| stats values(Image) as child_images values(CommandLine) as cmdlines values(User) as users values(IntegrityLevel) as integrity count by _time Computer ParentProcessGuid ProcessGuid
| table _time Computer ParentProcessGuid ProcessGuid child_images cmdlines users integrity mitre detection_id severity
```

### Microsoft KQL

```kql
let window = 24h;
DeviceProcessEvents
| where Timestamp > ago(window)
| where InitiatingProcessFileName =~ "userinit.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
    or ProcessCommandLine matches regex @"(?i)whoami\s+/priv"
| extend IsSystem = AccountName =~ "system" or ProcessIntegrityLevel =~ "System"
| extend WhoamiPriv = ProcessCommandLine matches regex @"(?i)whoami\s+/priv"
| where IsSystem or WhoamiPriv
| project Timestamp, DeviceName, AccountName, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId
| extend DetectionId = "TL-2026-0523-SPL-003", MitreMapping = "T1134,T1134.002,T1059.003,T1037.001,T1068", Severity = "critical"
```

### Sigma

```yaml
title: MiniPlasma — userinit.exe Spawns SYSTEM Interpreter With whoami /priv
id: 9b3c1f03-0523-4a03-9003-userinit03sysspawn
status: experimental
description: Detects the post-exploit execution chain shipped in the MiniPlasma PoC — userinit.exe spawning cmd.exe / powershell.exe / rundll32.exe under SYSTEM via UserInitMprLogonScript, with the canonical whoami /priv command-line marker.
references:
    - https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/
    - https://bugs.chromium.org/p/project-zero/issues/detail?id=2096
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/17
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1134
    - attack.t1134.002
    - attack.persistence
    - attack.t1037.001
    - attack.execution
    - attack.t1059.003
    - cve.2020.17103
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\System32\userinit.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_whoami:
        CommandLine|contains|all:
            - 'whoami'
            - '/priv'
    selection_system_token:
        User|contains:
            - 'SYSTEM'
            - 'NT AUTHORITY'
        IntegrityLevel: 'System'
    condition: selection_parent and (selection_child or selection_whoami) and selection_system_token
fields:
    - Image
    - ParentImage
    - User
    - CommandLine
    - IntegrityLevel
falsepositives:
    - Group Policy logon scripts legitimately invoked by userinit.exe (typically run in the user token, not SYSTEM)
    - Domain login hooks that spawn cscript/wscript for inventory tasks
level: critical
```

**Known false positives:**

- Group Policy logon scripts legitimately invoked by userinit.exe (usually in user token, not SYSTEM — filtered by selection_system_token).
- Domain login hooks that spawn cscript/wscript for inventory tasks under user context.
- Enterprise MDM agents wrapping logon initialization.

**Tuning notes:** The combination of (userinit parent) + (SYSTEM token) + (interpreter child) is the highest-fidelity signal. The whoami /priv command-line marker only matches the unmodified PoC — repacked variants will swap this. Drop the whoami /priv constraint and rely on parent/child/token for production hunting. Correlate with TL-2026-0523-SPL-002 within 5 minutes of next interactive logon for end-to-end chain detection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MiniPlasma — Cloud Files Placeholder Drop With FILE_ATTRIBUTE_RECALL_ON_OPEN Outside Sync Root (Exploitation) (locked: unlock with TL Creds)
- MiniPlasma — Registry Modification of HKU\.DEFAULT By Non-Privileged Token (Post-Exploitation) (locked: unlock with TL Creds)
- MiniPlasma — SYSTEM Process Tree Rooted in userinit.exe Post-Logon (Post-Exploit SYSTEM Execution Chain) (locked: unlock with TL Creds)
- MiniPlasma — FSCTL_HSM_CONTROL_ABORT_HYDRATION Issued To cldflt By Non-Sync-Engine Process (Exploitation Trigger) (locked: unlock with TL Creds)
- MiniPlasma — Composite Kill-Chain Correlation (cldapi Load + .DEFAULT Write + userinit SYSTEM Spawn) (locked: unlock with TL Creds)
- MiniPlasma — Post-SYSTEM Lateral Movement and C2 Staging From userinit-Rooted Tree (locked: unlock with TL Creds)
- MiniPlasma — cldflt Device Handle + CfAbortHydration From Non-Sync-Engine Process (Exploitation) (locked: unlock with TL Creds)
- MiniPlasma — UserInitMprLogonScript Write to HKU\.DEFAULT Hive (Post-Exploitation Persistence) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 15)

Defanged, TLP:CLEAR.

- File hash: `a7f3b9c2d4e1f8a6b5c9d3e7f2a4b8c6d1e5f9a3b7c2d4e8f1a6b9c5d3e7f2a4`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BleepingComputer — New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released](https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/)
- [Google Project Zero Issue 2096 — Windows cldflt HsmpOpenOrCreatePlaceholderKey Privilege Escalation (Forshaw)](https://bugs.chromium.org/p/project-zero/issues/detail?id=2096)
- [NVD — CVE-2020-17103 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2020-17103)
- [Microsoft Security Update Guide — CVE-2020-17103](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17103)
- [Will Dormann (Tharros) — independent confirmation thread on Mastodon](https://infosec.exchange/@wdormann)
- [Chaotic Eclipse — MiniPlasma GitHub release](https://github.com/chaotic-eclipse/MiniPlasma)
- [Microsoft Learn — Cloud Files API CfAbortHydration](https://learn.microsoft.com/en-us/windows/win32/api/cfapi/nf-cfapi-cfaborthydration)
- [Forshaw — Pwn2Own 2021 cldflt research notes (Tianfu Cup follow-up)](https://googleprojectzero.blogspot.com/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0523