# HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation

> Security researcher MSNightmare (aka NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse) published an unreliable public PoC, HardBreacher, that takes control of Kaspersky Endpoint Security's UI process (avp.exe) to trigger a privileged file write into C:\Windows\System32 on a fully patched Windows 11 25H2 system running Kaspersky for Endpoint v14.0.0.504. No CVE has been assigned and Kaspersky has not published an advisory confirming or fixing the issue.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2258
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-kaspersky-endpoint-privilege-escalation-tl-2026-2258.webp?v=ca191f73 (Threadlinqs threat intel: HardBreacher Kaspersky LPE: Exploitation Status & Fix (TL-2026-2258) — Medium severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2258
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** UNCONFIRMED
- **Detections:** 9 (1 shown free below) · **IOCs:** 24

## Description

On 2026-08-31, GitHub user MSNightmare released HardBreacher, a proof-of-concept local elevation-of-privilege (EoP) exploit targeting Kaspersky Endpoint Security v14.0.0.504 on a fully patched Windows 11 25H2 host. The PoC does not require network access, social engineering, or an existing administrative foothold -- only a standard local user account on an endpoint running the affected Kaspersky build. GBHackers' reporting characterizes the flaw as enabling 'unprivileged users to gain SYSTEM-level privileges through local access,' though the author's own repository notes the code does not yet reliably achieve arbitrary SYSTEM-level code execution.

The exploit works by taking control of Kaspersky's UI process (avp.exe), which runs with kernel-adjacent, security-product-level file-system permissions to perform real-time inspection. According to the author, 'the Kaspersky completely loses it when you take control over the UI process,' after which the tool can influence the product's internal file-operation decisions and write a marker file, MY_SNAKE_IS_SOLID.dll, into C:\Windows\System32 with full permissions granted to the invoking standard user -- a path normally protected by NTFS DACLs and Windows path virtualization. Placing the payload directly inside the legitimate System32 tree, rather than a user-writable location, blends the artifact with genuine OS/vendor files. The payload component is built as a Windows DLL (Visual C++ project 'SolidSnake': dllmain.cpp, framework.h, pch.h/.cpp) that includes ntdll.h, indicating use of undocumented/internal NT API calls rather than only public Win32 calls, consistent with a process-injection-based takeover of the target process; the GitHub repository README itself contains no explicit listing of individual Win32 API calls used.

The author explicitly describes the tool as a 'duct taped' proof-of-concept ('I just managed to make it work'): execution is unreliable, 'often ends in error, requiring retries,' and can leave the endpoint in a degraded state -- Kaspersky 'can stop functioning' or unpredictably 'grant/block access to files it's not supposed to.' GBHackers' coverage also frames a broader potential impact chain -- disabling security defenses, accessing protected data, and using credentials/tokens exposed to higher-privileged contexts for persistence or lateral movement -- but this framing is presented as potential downstream risk rather than something the PoC itself demonstrates; no persistence or lateral-movement behavior is documented in the exploit code or README. No coordinated disclosure to Kaspersky is documented in the repository.

HardBreacher was released the same day as two companion zero-day PoCs by the same researcher: PrettyPrague (a sandbox-escape EoP against fully patched Avast/Gen Digital Antivirus that dumps the SAM database and spawns a full SYSTEM shell) and GreenSection (an out-of-bounds write in a global NVIDIA user-mode shared-memory section, triggerable by any Vulkan- or OpenGL-using application, that can cross user boundaries or compromise the dwm.exe process). This researcher -- publicly known as MSNightmare / NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse -- has a documented Spring-2026 history of publishing unconfirmed, largely uncoordinated PoCs against Windows security tooling and OS components: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, ShieldBreak, RoguePlanet (referencing the already-patched, NVD-published CVE-2026-50656, a Microsoft Malware Protection Engine EoP), LegacyHive (Windows ProfSvc), and GreatXML (a BitLocker bypass); some of these prior PoCs reportedly achieved SYSTEM privileges or disk-protection bypass. A single Spanish-language outlet (securitylab.lat) additionally reports that Microsoft closed the researcher's coordinated-disclosure account over an alleged breach of reporting terms, a claim Microsoft is reported to dispute as uncoordinated disclosure on the researcher's part; this dispute is uncorroborated elsewhere and treated here as unverified context for the researcher's current shift toward non-Microsoft targets (Kaspersky, Avast, NVIDIA).

As of this writing, no CVE has been assigned to the Kaspersky flaw and no bulletin referencing HardBreacher or Kaspersky Endpoint Security v14.0.0.504 appears on Kaspersky's own advisory feed (threats.kaspersky.com). One Russian-language outlet (anti-malware.ru), and separately securitylab.lat, reported -- citing unnamed/unofficial sourcing -- that Kaspersky had already shipped an automatic fix ('обновление с необходимыми исправлениями выпущено и устанавливается автоматически'); this claim is uncorroborated by Kaspersky's own advisory channel or by any independently verifiable technical bulletin and is treated here as unverified.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1587.004 Develop Capabilities: Exploits
- T1106 Native API
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1222.001 Windows Permissions
- T1036.005 Match Legitimate Resource Name or Location
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Suspicious Process Access / Remote Thread Injection into Kaspersky avp.exe (HardBreacher UI-Process Takeover)** (`TL-2026-2258-SPL-001`)

Detects a non-Kaspersky-signed process obtaining a memory-write/thread-creation-capable access mask against Kaspersky Endpoint Security's UI process (avp.exe), or creating a remote thread inside it, from a standard (non-SYSTEM/service) user context. This matches HardBreacher's documented technique of taking control of avp.exe via its SolidSnake DLL component (built against ntdll.h, indicating Native API / undocumented NT call usage) to subvert the product's file-operation decisions.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055.001, T1106, T1548, T1068
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=10 OR EventCode=8)
| eval TargetImage=lower(TargetImage)
| where match(TargetImage, "\\\\avp\.exe$")
| eval SourceImage=lower(SourceImage)
| where NOT match(SourceImage, "kaspersky lab")
| eval User=lower(User)
| where NOT match(User, "nt authority\\\\system|nt authority\\\\local service|nt authority\\\\network service")
| eval GrantedAccess=coalesce(GrantedAccess,"n/a")
| where EventCode=8 OR match(GrantedAccess, "0x1[4F][013][0F][0F]{1,2}")
| stats count min(_time) as first_seen max(_time) as last_seen values(SourceImage) as source_processes values(User) as user_context values(GrantedAccess) as access_masks by ComputerName TargetImage EventCode
| where count>0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "avp.exe"
| where InitiatingProcessFileName !in~ ("avp.exe","avpui.exe","ksde.exe","kavfswp.exe","kavfs.exe")
| where InitiatingProcessFolderPath !has "kaspersky lab"
| join kind=inner (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("ProcessInjectionApiCall","RemoteThreadCreated","OpenProcessApiCall")
) on DeviceName
| where abs(datetime_diff('second', Timestamp, Timestamp1)) < 30
| where InitiatingProcessAccountName !in~ ("system","local service","network service")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType
```

### Sigma

```yaml
title: Kaspersky avp.exe UI-Process Injection Consistent with HardBreacher
id: 8f3c1b2a-4d5e-4a11-9c7f-1a2b3c4d5e6f
status: experimental
description: Detects an unsigned, non-Kaspersky process obtaining a suspicious access mask against or injecting into avp.exe (Kaspersky Endpoint Security UI process), consistent with the HardBreacher PoC's SolidSnake DLL takeover technique.
references:
    - https://github.com/MSNightmare/HardBreacher
    - https://gbhackers.com/hardbreacher-exploit-targets-kaspersky-endpoint-security/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.privilege-escalation
    - attack.t1055.001
    - attack.t1106
    - attack.t1548
    - attack.execution
logsource:
    category: process_access
    product: windows
detection:
    selection_target:
        TargetImage|endswith: '\avp.exe'
    filter_source_signed:
        SourceImage|contains: 'Kaspersky Lab'
    filter_system:
        User|contains:
            - 'NT AUTHORITY\SYSTEM'
            - 'NT AUTHORITY\LOCAL SERVICE'
            - 'NT AUTHORITY\NETWORK SERVICE'
    selection_access:
        GrantedAccess|re: '0x1[4F][013][0F][0F]{1,2}'
    condition: selection_target and not filter_source_signed and not filter_system and selection_access
falsepositives:
    - Kaspersky's own self-protection or update components briefly accessing avp.exe during legitimate maintenance
    - EDR/AV vendor agents performing routine process introspection of security products
level: high
```

**Known false positives:**

- Kaspersky's own update/self-protection service components briefly re-attaching to avp.exe during patching
- Other endpoint security or EDR agents performing legitimate process introspection of avp.exe for compatibility checks

**Tuning notes:** Baseline the GrantedAccess mask values seen from legitimate Kaspersky-signed processes in your environment before enabling in blocking mode; the PoC is documented as unreliable and may retry access attempts, so consider a burst threshold (>=3 access attempts/host/hour) to reduce noise from failed exploit retries.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- HardBreacher / SolidSnake PoC Binary Execution or Load (locked: unlock with TL Creds)
- Standard User Executing PoC Exploit Immediately Prior to System32 Write (No Prior Admin Elevation) (locked: unlock with TL Creds)
- Kaspersky Protection-Status Registry Change Correlated with avp.exe Access Anomaly (locked: unlock with TL Creds)
- Unprivileged File Write into System32 Mediated by Kaspersky avp.exe (locked: unlock with TL Creds)
- Native API (ntdll.dll) Direct-Syscall Behavior from Process Targeting Kaspersky avp.exe (locked: unlock with TL Creds)
- Kaspersky Real-Time Protection Disabled or Degraded Following Suspected Exploitation Attempt (locked: unlock with TL Creds)
- Kaspersky Endpoint Security Service Crash or Stop Following Anomalous avp.exe Access (locked: unlock with TL Creds)
- Repeated Failed Exploitation Attempts Against avp.exe (PoC Unreliability Signature) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [HardBreacher Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Privilege Escalation](https://gbhackers.com/hardbreacher-exploit-targets-kaspersky-endpoint-security/)
- [MSNightmare/HardBreacher: Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability](https://github.com/MSNightmare/HardBreacher)
- [HardBreacher/SolidSnake source directory](https://github.com/MSNightmare/HardBreacher/tree/main/SolidSnake)
- [Guardian Turned Gatekeeper: Zero-Day EoP in Kaspersky Endpoint Security Lets Attackers Own the Protector](https://malwaretips.com/threads/big-breaking-guardian-turned-gatekeeper-zero-day-eop-in-kaspersky-endpoint-security-lets-attackers-own-the-protector.142998/)
- [NightmareEclipse se cansó de romper Windows: esta vez atacó a Kaspersky, Avast y NVIDIA](https://www.securitylab.lat/news/576687.php)
- [Исследователь заставил Kaspersky Endpoint Security записать DLL в System32](https://www.anti-malware.ru/news/2026-08-31-111332/51233)
- [Nightmare Eclipse теперь против Касперского. На GitHub опубликован 0day в Kaspersky Endpoint Security](https://news.rambler.ru/tech/56987661-nightmare-eclipse-teper-protiv-kasperskogo-na-github-opublikovan-0day-v-kaspersky-endpoint-security/)
- [MSNightmare (INFINITE NIGHTMARE) repositories](https://github.com/MSNightmare?tab=repositories)
- [NVD CVE-2026-50656 (RoguePlanet, Microsoft Malware Protection Engine EoP -- same researcher, prior disclosure)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-50656)
- [MSNightmare/PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability (companion same-day PoC)](https://github.com/MSNightmare/PrettyPrague)
- [MSNightmare/GreenSection: Nvidia GreenSection Memory Corruption 0day vulnerability (companion same-day PoC)](https://github.com/MSNightmare/GreenSection)
- [The Buckler Report: Exploit Alert: Nvidia GreenSection Memory Corruption 0day vulnerability](https://news.kenbuckler.com/2026/08/exploit-alert-nvidia-greensection.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2258