# Windows Minifilter Driver N-day Privilege Escalation - Public PoC (ALPC Write Primitive / PPID Spoofing Exploits)

> Security researcher Alexandre Borges published a 296-page deep-dive (Exploiting Reversing series, Article 06) detailing a stable, working local privilege escalation against an undisclosed Windows minifilter driver N-day, shipping two distinct public PoC exploitation paths: an ALPC write-primitive edition (regular user to SYSTEM) and a parent-process-ID (PPID) spoofing edition (administrator to SYSTEM).

- **Published:** 2026-10-31T04:12:36Z
- **Last reviewed:** 2026-10-31T04:12:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4878
- **ID:** TL-2026-4878
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-30085

## Description

On 2026-02-11, Alexandre Borges released the sixth installment of his Exploiting Reversing (ERS) series on exploitreversing.com: a 296-page technical deep dive into exploiting an N-day vulnerability in a Windows minifilter driver (file-system filter driver operating via the Filter Manager / FltMgr framework). The public source material does not disclose the specific driver name, vendor, affected product versions, or a CVE identifier, and no CVSS score is stated by the author; this record documents the PoC and exploitation methodology as published rather than inferring unstated technical attribution.

The research presents two independent, 'completely stable and working' exploitation editions against the same underlying minifilter flaw. The first, the ALPC write-primitive edition, escalates a regular (non-administrator) local user to SYSTEM by abusing Asynchronous Local Procedure Call (ALPC) communication with the vulnerable driver to obtain an attacker-controlled kernel write primitive, which is then used to corrupt kernel state (consistent with the token-manipulation / EPROCESS-token-swap pattern Borges documents elsewhere in the same series for similar minifilter-class bugs) and achieve SYSTEM code execution. The second, the PPID-spoofing edition, escalates a local administrator account to SYSTEM by abusing the driver to spoof the parent process ID of a newly created process, defeating process-lineage assumptions used by security tooling and driver-side validation logic.

The article underwent a documented post-release revision: Revision C.1, published 2026-03-24, refined the ALPC write-primitive exploit with new memory-spray staging and an extended 'cleaner' phase specifically engineered to prevent system crashes (BSOD) and guarantee a stable exit after privilege escalation — indicating the original edition had reliability/crash-safety limitations that were subsequently hardened. Borges' broader ERS catalog situates Article 06 between Article 05 (Hyper-V exploitation, part 01) and Articles 07-09 (a three-part deep dive into CVE-2024-30085, a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver, cldflt.sys, that was fixed by Microsoft in KB5039211 and independently analyzed by STAR Labs, Theori, and Core Security researchers using WNF out-of-bounds, pipe-attribute spraying, and ALPC-handle-table pointer leaks to build arbitrary kernel read/write primitives). While CVE-2024-30085 is a distinct, already-patched vulnerability in a different (named) minifilter driver and is not the subject of this record, it establishes the author's demonstrated, repeatable methodology (binary diffing against patched driver builds, ALPC/WNF-based primitive construction, token-privilege overwrite) that the Article 06 N-day exploit draws on and extends to a second, unnamed minifilter driver.

No in-the-wild exploitation has been reported for this specific N-day. Exploitability is elevated by the fact that both PoC editions are described by the author as stable and working, and the material is further supported by binary-diffing methodology, IDA Pro (Hex-Rays) based reverse engineering, and a dedicated reliability-focused revision cycle, which together lower the bar for weaponization by third parties who obtain the research.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1587.004 Develop Capabilities: Exploits
- T1134 Access Token Manipulation
- T1134.004 Access Token Manipulation: Parent PID Spoofing
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1106 Native API
- T1082 System Information Discovery
- T1078 Valid Accounts

## Sources

- [Exploiting Reversing (ER) series: article 06 | A Deep Dive Into Exploiting a Minifilter Driver (N-day)](https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/)
- [Exploiting Reversing Series (ERS) and Memory Attack Series (MAS) by Alexandre Borges](https://undercodetesting.com/exploiting-reversing-series-ers-and-memory-attack-series-mas-by-alexandre-borges/)
- [A Deep Dive Into Exploiting a Minifilter Driver: From Binary Diffing to Full N-Day Exploitation](https://undercodetesting.com/a-deep-dive-into-exploiting-a-minifilter-driver-from-binary-diffing-to-full-n-day-exploitation-video/)
- [All I Want for Christmas is a CVE-2024-30085 Exploit](https://starlabs.sg/blog/2024/12-all-i-want-for-christmas-is-a-cve-2024-30085-exploit/)
- [Root Cause Analysis - CVE-2024-30085 (Windows Cloud Files Mini Filter Driver)](https://onlyfm252.starlabs.sg/data/patch_diffs/rca-cve-2024-30085.md)
- [CVE-2024-30085: From Regular User to SYSTEM - Mastering Dual Kernel Heap Overflow Exploits](https://undercodetesting.com/cve-2024-30085-from-regular-user-to-system-mastering-dual-kernel-heap-overflow-exploits-106-page-deep-dive-video/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4878