HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation

Key facts for Kaspersky endpoint privilege escalation

Detection coverage for Kaspersky endpoint privilege escalation

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2258 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Suspicious Process Access / Remote Thread Injection into Kaspersky avp.exe (HardBreacher UI-Process Takeover)

Detects a non-Kaspersky-signed process obtaining a memory-write/thread-creation-capable access mask against Kaspersky Endpoint Security's UI process (avp.exe), or creating a remote thread inside it, from a standard (non-SYSTEM/service) user context. This matches HardBreacher's documented technique of taking control of avp.exe via its SolidSnake DLL component (built against ntdll.h, indicating Native API / undocumented NT call usage) to subvert the product's file-operation decisions.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.001, T1106, T1548, T1068
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=10 OR EventCode=8)
| eval TargetImage=lower(TargetImage)
| where match(TargetImage, "\\\\avp\.exe$")
| eval SourceImage=lower(SourceImage)
| where NOT match(SourceImage, "kaspersky lab")
| eval User=lower(User)
| where NOT match(User, "nt authority\\\\system|nt authority\\\\local service|nt authority\\\\network service")
| eval GrantedAccess=coalesce(GrantedAccess,"n/a")
| where EventCode=8 OR match(GrantedAccess, "0x1[4F][013][0F][0F]{1,2}")
| stats count min(_time) as first_seen max(_time) as last_seen values(SourceImage) as source_processes values(User) as user_context values(GrantedAccess) as access_masks by ComputerName TargetImage EventCode
| where count>0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "avp.exe"
| where InitiatingProcessFileName !in~ ("avp.exe","avpui.exe","ksde.exe","kavfswp.exe","kavfs.exe")
| where InitiatingProcessFolderPath !has "kaspersky lab"
| join kind=inner (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("ProcessInjectionApiCall","RemoteThreadCreated","OpenProcessApiCall")
) on DeviceName
| where abs(datetime_diff('second', Timestamp, Timestamp1)) < 30
| where InitiatingProcessAccountName !in~ ("system","local service","network service")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType

Sigma

title: Kaspersky avp.exe UI-Process Injection Consistent with HardBreacher
id: 8f3c1b2a-4d5e-4a11-9c7f-1a2b3c4d5e6f
status: experimental
description: Detects an unsigned, non-Kaspersky process obtaining a suspicious access mask against or injecting into avp.exe (Kaspersky Endpoint Security UI process), consistent with the HardBreacher PoC's SolidSnake DLL takeover technique.
references:
    - https://github.com/MSNightmare/HardBreacher
    - https://gbhackers.com/hardbreacher-exploit-targets-kaspersky-endpoint-security/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.privilege-escalation
    - attack.t1055.001
    - attack.t1106
    - attack.t1548
    - attack.execution
logsource:
    category: process_access
    product: windows
detection:
    selection_target:
        TargetImage|endswith: '\avp.exe'
    filter_source_signed:
        SourceImage|contains: 'Kaspersky Lab'
    filter_system:
        User|contains:
            - 'NT AUTHORITY\SYSTEM'
            - 'NT AUTHORITY\LOCAL SERVICE'
            - 'NT AUTHORITY\NETWORK SERVICE'
    selection_access:
        GrantedAccess|re: '0x1[4F][013][0F][0F]{1,2}'
    condition: selection_target and not filter_source_signed and not filter_system and selection_access
falsepositives:
    - Kaspersky's own self-protection or update components briefly accessing avp.exe during legitimate maintenance
    - EDR/AV vendor agents performing routine process introspection of security products
level: high

Known false positives:

• Kaspersky's own update/self-protection service components briefly re-attaching to avp.exe during patching
• Other endpoint security or EDR agents performing legitimate process introspection of avp.exe for compatibility checks

Tuning notes: Baseline the GrantedAccess mask values seen from legitimate Kaspersky-signed processes in your environment before enabling in blocking mode; the PoC is documented as unreliable and may retry access attempts, so consider a burst threshold (>=3 access attempts/host/hour) to reduce noise from failed exploit retries.

• 🔒 HardBreacher / SolidSnake PoC Binary Execution or Load · unlock with TL Creds
• 🔒 Standard User Executing PoC Exploit Immediately Prior to System32 Write (No Prior Admin Elevation) · unlock with TL Creds
• 🔒 Kaspersky Protection-Status Registry Change Correlated with avp.exe Access Anomaly · unlock with TL Creds
• 🔒 Unprivileged File Write into System32 Mediated by Kaspersky avp.exe · unlock with TL Creds
• 🔒 Native API (ntdll.dll) Direct-Syscall Behavior from Process Targeting Kaspersky avp.exe · unlock with TL Creds
• 🔒 Kaspersky Real-Time Protection Disabled or Degraded Following Suspected Exploitation Attempt · unlock with TL Creds
• 🔒 Kaspersky Endpoint Security Service Crash or Stop Following Anomalous avp.exe Access · unlock with TL Creds
• 🔒 Repeated Failed Exploitation Attempts Against avp.exe (PoC Unreliability Signature) · unlock with TL Creds

Indicators of compromise for Kaspersky endpoint privilege escalation

As of 2026-08-31, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2258.

How Kaspersky endpoint privilege escalation works

No CVE has been assigned and Kaspersky has not published an advisory confirming or fixing the issue.

On 2026-08-31, GitHub user MSNightmare released HardBreacher, a proof-of-concept local elevation-of-privilege (EoP) exploit targeting Kaspersky Endpoint Security v14.0.0.504 on a fully patched Windows 11 25H2 host. The PoC does not require network access, social engineering, or an existing administrative foothold -- only a standard local user account on an endpoint running the affected Kaspersky build. GBHackers' reporting characterizes the flaw as enabling 'unprivileged users to gain SYSTEM-level privileges through local access,' though the author's own repository notes the code does not yet reliably achieve arbitrary SYSTEM-level code execution.

The exploit works by taking control of Kaspersky's UI process (avp.exe), which runs with kernel-adjacent, security-product-level file-system permissions to perform real-time inspection. According to the author, 'the Kaspersky completely loses it when you take control over the UI process,' after which the tool can influence the product's internal file-operation decisions and write a marker file, MY_SNAKE_IS_SOLID.dll, into C:\Windows\System32 with full permissions granted to the invoking standard user -- a path normally protected by NTFS DACLs and Windows path virtualization. Placing the payload directly inside the legitimate System32 tree, rather than a user-writable location, blends the artifact with genuine OS/vendor files. The payload component is built as a Windows DLL (Visual C++ project 'SolidSnake': dllmain.cpp, framework.h, pch.h/.cpp) that includes ntdll.h, indicating use of undocumented/internal NT API calls rather than only public Win32 calls, consistent with a process-injection-based takeover of the target process; the GitHub repository README itself contains no explicit listing of individual Win32 API calls used.

The author explicitly describes the tool as a 'duct taped' proof-of-concept ('I just managed to make it work'): execution is unreliable, 'often ends in error, requiring retries,' and can leave the endpoint in a degraded state -- Kaspersky 'can stop functioning' or unpredictably 'grant/block access to files it's not supposed to.' GBHackers' coverage also frames a broader potential impact chain -- disabling security defenses, accessing protected data, and using credentials/tokens exposed to higher-privileged contexts for persistence or lateral movement -- but this framing is presented as potential downstream risk rather than something the PoC itself demonstrates; no persistence or lateral-movement behavior is documented in the exploit code or README. No coordinated disclosure to Kaspersky is documented in the repository.

HardBreacher was released the same day as two companion zero-day PoCs by the same researcher: PrettyPrague (a sandbox-escape EoP against fully patched Avast/Gen Digital Antivirus that dumps the SAM database and spawns a full SYSTEM shell) and GreenSection (an out-of-bounds write in a global NVIDIA user-mode shared-memory section, triggerable by any Vulkan- or OpenGL-using application, that can cross user boundaries or compromise the dwm.exe process). This researcher -- publicly known as MSNightmare / NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse -- has a documented Spring-2026 history of publishing unconfirmed, largely uncoordinated PoCs against Windows security tooling and OS components: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, ShieldBreak, RoguePlanet (referencing the already-patched, NVD-published CVE-2026-50656, a Microsoft Malware Protection Engine EoP), LegacyHive (Windows ProfSvc), and GreatXML (a BitLocker bypass); some of these prior PoCs reportedly achieved SYSTEM privileges or disk-protection bypass. A single Spanish-language outlet (securitylab.lat) additionally reports that Microsoft closed the researcher's coordinated-disclosure account over an alleged breach of reporting terms, a claim Microsoft is reported to dispute as uncoordinated disclosure on the researcher's part; this dispute is uncorroborated elsewhere and treated here as unverified context for the researcher's current shift toward non-Microsoft targets (Kaspersky, Avast, NVIDIA).

As of this writing, no CVE has been assigned to the Kaspersky flaw and no bulletin referencing HardBreacher or Kaspersky Endpoint Security v14.0.0.504 appears on Kaspersky's own advisory feed (threats.kaspersky.com). One Russian-language outlet (anti-malware.ru), and separately securitylab.lat, reported -- citing unnamed/unofficial sourcing -- that Kaspersky had already shipped an automatic fix ('обновление с необходимыми исправлениями выпущено и устанавливается автоматически'); this claim is uncorroborated by Kaspersky's own advisory channel or by any independently verifiable technical bulletin and is treated here as unverified.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Privilege Escalation

T1055.001 Process Injection: Dynamic-link Library Injection; T1548 Abuse Elevation Control Mechanism

Execution

T1106 Native API

defense-impairment

T1222.001 Windows Permissions; T1685 Disable or Modify Tools

Impact

T1489 Service Stop

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Remediation for Kaspersky endpoint privilege escalation

Immediate actions

• Monitor Kaspersky Endpoint Security's UI process (avp.exe) with EDR/behavioral telemetry for unexpected DLL loads, remote thread creation, or window/process manipulation by unprivileged processes
• Alert on file-creation events under C:\Windows\System32 that are attributable to a standard (non-administrative) user security context or to security-product processes acting on behalf of one
• Apply application allowlisting to restrict which unsigned/unknown binaries standard users can execute on endpoints running Kaspersky Endpoint Security

Workarounds

• No vendor-endorsed workaround has been published. The PoC's documented unreliability (frequent failures, required retries) reduces near-term reliable weaponization risk but should not be treated as a mitigation

Longer-term hardening

• Track threats.kaspersky.com and Kaspersky's official support channels for a KLA bulletin or CVE referencing this issue; none exists as of 2026-08-31
• Apply Kaspersky Endpoint Security updates promptly once a vendor-confirmed fixed build is published
• Review EDR/self-protection tamper coverage across all deployed security tools -- the same researcher published companion same-day PoCs against Avast and NVIDIA components

Affected and fixed versions

• Kaspersky — Kaspersky Endpoint Security (Kaspersky Antivirus for Endpoint)
  Vulnerable versions: 14.0.0.504

Timeline of Kaspersky endpoint privilege escalation

• 2026-06-16 NVD publishes CVE-2026-50656 ('locked-ioc-12'), an elevation-of-privilege flaw in the locked-ioc-21 Malware Protection Engine used by locked-ioc-21 Defender, previously disclosed by the same researcher (locked-ioc-10/locked-ioc-6) -- establishing a documented pattern of security-tool-targeting disclosures predating locked-ioc-7.
• 2026-08-31 No official locked-ioc-19 security advisory (KLA bulletin) or CVE referencing locked-ioc-7 or locked-ioc-19 Endpoint Security v14.0.0.504 has been published or located as of this date; threats.locked-ioc-19.com has no matching entry.
• 2026-08-31 anti-malware.ru reports, citing unnamed sourcing, that locked-ioc-19 released an automatic update resolving the issue found by locked-ioc-7; this claim is not corroborated by locked-ioc-19's own advisory feed or by any other outlet as of this writing.
• 2026-08-31 Russian-language outlets (anti-malware.ru, securitylab.lat, Rambler News) publish coverage of the locked-ioc-7 disclosure and the researcher's broader pattern of targeting security vendors the same day.
• 2026-08-31 MalwareTips security forum publishes community discussion and a technical breakdown of the locked-ioc-7 disclosure.
• 2026-08-31 GBHackers publishes the first English-language security-news coverage of locked-ioc-7, noting no CVE assignment and no locked-ioc-19 confirmation at time of writing.
• 2026-08-31 The same researcher simultaneously publishes two related zero-day PoCs against other vendors: locked-ioc-8 (Avast Antivirus sandbox-escape EoP) and locked-ioc-9 (NVIDIA shared-memory out-of-bounds write).
• 2026-08-31 locked-ioc-10 publishes the locked-ioc-7 proof-of-concept on GitHub (MIT license), describing a local elevation-of-privilege flaw in locked-ioc-19 Endpoint Security v14.0.0.504 on fully patched Windows 11 25H2.

Sources cited for Kaspersky endpoint privilege escalation

• NVD CVE-2026-50656 (RoguePlanet, Microsoft Malware Protection Engine EoP -- same researcher, prior disclosure) NVD (NIST) · Research · 2026-06-16
• MSNightmare/HardBreacher: Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability GitHub · Code repository · 2026-08-31
• HardBreacher/SolidSnake source directory GitHub · Code repository · 2026-08-31
• MSNightmare (INFINITE NIGHTMARE) repositories GitHub · Code repository · 2026-08-31
• MSNightmare/PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability (companion same-day PoC) GitHub · Code repository · 2026-08-31
• MSNightmare/GreenSection: Nvidia GreenSection Memory Corruption 0day vulnerability (companion same-day PoC) GitHub · Code repository · 2026-08-31
• Guardian Turned Gatekeeper: Zero-Day EoP in Kaspersky Endpoint Security Lets Attackers Own the Protector malwaretips.com · Blog · 2026-08-31
• The Buckler Report: Exploit Alert: Nvidia GreenSection Memory Corruption 0day vulnerability news.kenbuckler.com · Blog · 2026-08-31
• HardBreacher Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Privilege Escalation gbhackers.com · News · 2026-08-31
• NightmareEclipse se cansó de romper Windows: esta vez atacó a Kaspersky, Avast y NVIDIA securitylab.lat · News · 2026-08-31
• Исследователь заставил Kaspersky Endpoint Security записать DLL в System32 anti-malware.ru · News · 2026-08-31
• Nightmare Eclipse теперь против Касперского. На GitHub опубликован 0day в Kaspersky Endpoint Security news.rambler.ru · News · 2026-08-31

Threats related to Kaspersky endpoint privilege escalation

• AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)
• Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites

Previous and next in vulnerability

• Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation) Previous report
• CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation Next report