Threat reportVulnerabilityTL-2026-4878
Windows Minifilter Driver N-day Privilege Escalation - Public PoC (ALPC Write Primitive / PPID Spoofing Exploits)
Windows Minifilter Driver N-day Privilege Escalation (TL-2026-4878) is a high-severity software vulnerability, first published 2026-10-31. It has no confirmed attribution, references 1 CVE (CVE-2024-30085), maps to 9 MITRE ATT&CK techniques (T1078, T1082, T1106), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4878
- Threat ID
- TL-2026-4878
- Severity
- HIGH
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Windows Minifilter Driver N-day Privilege Escalation
Malware and tooling: None identified, IDA Pro
How Windows Minifilter Driver N-day Privilege Escalation works
Security researcher Alexandre Borges published a 296-page deep-dive (Exploiting Reversing series, Article 06) detailing a stable, working local privilege escalation against an undisclosed Windows minifilter driver N-day, shipping two distinct public PoC exploitation paths: an ALPC write-primitive edition (regular user to SYSTEM) and a parent-process-ID (PPID) spoofing edition (administrator to SYSTEM).
On 2026-02-11, Alexandre Borges released the sixth installment of his Exploiting Reversing (ERS) series on exploitreversing.com: a 296-page technical deep dive into exploiting an N-day vulnerability in a Windows minifilter driver (file-system filter driver operating via the Filter Manager / FltMgr framework). The public source material does not disclose the specific driver name, vendor, affected product versions, or a CVE identifier, and no CVSS score is stated by the author; this record documents the PoC and exploitation methodology as published rather than inferring unstated technical attribution.
The research presents two independent, 'completely stable and working' exploitation editions against the same underlying minifilter flaw. The first, the ALPC write-primitive edition, escalates a regular (non-administrator) local user to SYSTEM by abusing Asynchronous Local Procedure Call (ALPC) communication with the vulnerable driver to obtain an attacker-controlled kernel write primitive, which is then used to corrupt kernel state (consistent with the token-manipulation / EPROCESS-token-swap pattern Borges documents elsewhere in the same series for similar minifilter-class bugs) and achieve SYSTEM code execution. The second, the PPID-spoofing edition, escalates a local administrator account to SYSTEM by abusing the driver to spoof the parent process ID of a newly created process, defeating process-lineage assumptions used by security tooling and driver-side validation logic.
The article underwent a documented post-release revision: Revision C.1, published 2026-03-24, refined the ALPC write-primitive exploit with new memory-spray staging and an extended 'cleaner' phase specifically engineered to prevent system crashes (BSOD) and guarantee a stable exit after privilege escalation — indicating the original edition had reliability/crash-safety limitations that were subsequently hardened. Borges' broader ERS catalog situates Article 06 between Article 05 (Hyper-V exploitation, part 01) and Articles 07-09 (a three-part deep dive into CVE-2024-30085, a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver, cldflt.sys, that was fixed by Microsoft in KB5039211 and independently analyzed by STAR Labs, Theori, and Core Security researchers using WNF out-of-bounds, pipe-attribute spraying, and ALPC-handle-table pointer leaks to build arbitrary kernel read/write primitives). While CVE-2024-30085 is a distinct, already-patched vulnerability in a different (named) minifilter driver and is not the subject of this record, it establishes the author's demonstrated, repeatable methodology (binary diffing against patched driver builds, ALPC/WNF-based primitive construction, token-privilege overwrite) that the Article 06 N-day exploit draws on and extends to a second, unnamed minifilter driver.
No in-the-wild exploitation has been reported for this specific N-day. Exploitability is elevated by the fact that both PoC editions are described by the author as stable and working, and the material is further supported by binary-diffing methodology, IDA Pro (Hex-Rays) based reverse engineering, and a dedicated reliability-focused revision cycle, which together lower the bar for weaponization by third parties who obtain the research.
MITRE ATT&CK techniques used in TL-2026-4878
Initial Access
Discovery
T1082 System Information Discovery
Execution
Defense Evasion
T1134 Access Token Manipulation; T1134.004 Access Token Manipulation: Parent PID Spoofing; T1211 Exploitation for Stealth
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits
Remediation for Windows Minifilter Driver N-day Privilege Escalation
Patches
- No vendor patch has been identified for this specific N-day at the time of publication; the affected driver, vendor, and fixed version were not disclosed in the public research material
Immediate actions
- Restrict and monitor local interactive/RDP access on systems where third-party minifilter drivers are installed until the specific vulnerable driver can be identified and patched or removed
- Deploy EDR rules to flag anomalous ALPC port creation/connection activity directed at kernel-mode filter driver components
- Deploy EDR/sysmon rules to flag process creation events with a spoofed or implausible parent process ID (PPID mismatch between reported and actual creator process)
- Audit local administrator group membership; the PPID-spoofing edition assumes an administrator starting point, so reducing standing admin accounts reduces the usable attack surface for that edition
Workarounds
- Inventory installed minifilter drivers with fltmc.exe (or Get-FilterDriver equivalents) and remove or disable unnecessary third-party minifilter drivers to reduce local privilege-escalation attack surface
- Where feasible, restrict which users/groups can communicate with installed minifilter driver ALPC ports via driver-specific ACL/configuration controls
Longer-term hardening
- Enable Hypervisor-Protected Code Integrity (HVCI) and Microsoft's vulnerable/recommended driver blocklist to constrain which kernel drivers, including third-party minifilters, can load
- Build kernel-mode telemetry (ETW driver-load auditing, FltMgr instance attach/detach logging) to detect abuse of minifilter driver communication ports
- Track exploitreversing.com ERS publications and revision notes for this driver family, since the author has a track record of iterating public exploits (e.g., the C.1 reliability revision) after initial release
CVEs associated with Windows Minifilter Driver N-day Privilege Escalation
Timeline of Windows Minifilter Driver N-day Privilege Escalation
- Article 06 is first observed and ingested as a threat hunt candidate on the basis of its public, working PoC criterion.
- Original PPID-spoofing edition of the exploit is released, escalating a local administrator account to SYSTEM via parent-process-ID spoofing.
- Original ALPC write-primitive edition of the exploit is released, escalating a regular local user to SYSTEM via a stable, working proof-of-concept.
- Alexandre Borges publishes Exploiting Reversing (ERS) Article 06, a 296-page deep dive into exploiting a Windows minifilter driver N-day, on exploitreversing.com.
- Revision C.1 extends the exploit's cleaner phase specifically to prevent system crashes (BSOD) and ensure a stable exit after SYSTEM privilege escalation, improving overall exploit reliability.
- Revision C.1 of Article 06 is published, refining the ALPC write-primitive exploit with new memory-spray staging.
Sources cited for Windows Minifilter Driver N-day Privilege Escalation
- Exploiting Reversing (ER) series: article 06 | A Deep Dive Into Exploiting a Minifilter Driver (N-day)
- Exploiting Reversing Series (ERS) and Memory Attack Series (MAS) by Alexandre Borges
- A Deep Dive Into Exploiting a Minifilter Driver: From Binary Diffing to Full N-Day Exploitation
- All I Want for Christmas is a CVE-2024-30085 Exploit
- Root Cause Analysis - CVE-2024-30085 (Windows Cloud Files Mini Filter Driver)
- CVE-2024-30085: From Regular User to SYSTEM - Mastering Dual Kernel Heap Overflow Exploits
Detection coverage for TL-2026-4878
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4878 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.