Public PoC for Windows Ancillary Function Driver for WinSock (afd.sys) Privilege Escalation - CVE-2023-21768

Key facts for Windows afd.sys LPE

Detection coverage for Windows afd.sys LPE

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5053 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SYSTEM Shell or Tool Spawned by Non-SYSTEM Parent — Post-Exploitation Token Theft

Detects the post-exploitation outcome of CVE-2023-21768: a low-privileged user process whose token becomes SYSTEM and spawns cmd, PowerShell, whoami or similar tooling. This is the primary behavioural indicator named in the research (low-privileged process acquiring a SYSTEM token) and is independent of binary name.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1134.001, T1068, T1078, T1059.003
• Data sources: sysmon
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where isnotnull(ParentUser) AND match(User,"(?i)system$") AND NOT match(ParentUser,"(?i)(system|local service|network service)$")
| where match(Image,"(?i).(cmd|powershell|pwsh|whoami|net1?|wmic|reg|sc|mshta|rundll32|cscript|wscript)[.]exe$")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_cmd by host, ParentUser, ParentImage, User, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountSid == "S-1-5-18"
| where isnotempty(InitiatingProcessAccountSid) and InitiatingProcessAccountSid !in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "net1.exe", "wmic.exe", "reg.exe", "sc.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: SYSTEM Shell or Tool Spawned by Non-SYSTEM Parent Process
id: 5b0e7c1a-3d52-4a6e-9f10-5053a0000002
status: experimental
description: Detects a SYSTEM-context shell or recon utility whose parent process runs as a regular user, the typical outcome of kernel token theft such as CVE-2023-21768.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-21768
    - https://www.ibm.com/think/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock
    - https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.privilege_escalation
    - attack.t1134.001
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - attack.initial_access
    - attack.t1078
    - cve.2023.21768
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        User:
            - 'NT AUTHORITY\SYSTEM'
            - 'AUTORITE NT\SYSTEM'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\wmic.exe'
            - '\reg.exe'
            - '\sc.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    filter_system_parent:
        ParentUser|contains:
            - 'AUTHORITY\SYSTEM'
            - 'AUTHORITY\LOCAL SERVICE'
            - 'AUTHORITY\NETWORK SERVICE'
            - 'AUTORITE NT\SYSTEM'
    condition: selection and not filter_system_parent
falsepositives:
    - Remote management agents that impersonate a user session before launching SYSTEM tasks
    - Authorized use of PsExec -s or similar from an elevated admin session
level: high

Known false positives:

• Admin tooling (PsExec -s, RMM agents) launching SYSTEM shells from a user session
• Installer bootstrappers that elevate to SYSTEM through legitimate services

Tuning notes: Requires Sysmon 13 or later for ParentUser. Allowlist approved RMM and deployment parents by ParentImage. Correlate with interactive or RDP logons for the same user within 30 minutes to raise fidelity, and weight hits on Windows 11 22H2 and Server 2022 hosts missing KB5022303.

• 🔒 Unsigned User-Writable Launcher With Single PID Argument — Exploitation · unlock with TL Creds
• 🔒 Integrity Level Jump to SYSTEM From User-Context Parent — Post-Exploitation · unlock with TL Creds
• 🔒 Proxy or Endpoint Access to chompie1337 PoC Repository — Tool Transfer · unlock with TL Creds
• 🔒 CVE-2023-21768 Public PoC Binary Name or Command Line — Exploitation · unlock with TL Creds
• 🔒 SYSTEM Shell Spawned From User-Writable Parent Path — Post-Exploitation · unlock with TL Creds
• 🔒 Command-Line Download of chompie1337 PoC — Tool Transfer · unlock with TL Creds
• 🔒 CVE-2023-21768 [indicator] LPE PoC Execution or Launcher Pattern — Exploitation · unlock with TL Creds
• 🔒 PoC Download From chompie1337 GitHub Repository — Tool Transfer · unlock with TL Creds

Indicators of compromise for Windows afd.sys LPE

As of 2026-11-02, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5053.

How Windows afd.sys LPE works

CVE-2023-21768 is a local elevation-of-privilege vulnerability in afd.sys, the Windows Ancillary Function Driver for WinSock. The root cause, per public patch-diff analysis, is a missing user-pointer validation (PreviousMode check without a probe) in afd!AfdNotifyRemoveIoCompletion, which allows a low-privileged local user to cause a kernel memory write. NVD classifies it as CWE-822 (Untrusted Pointer Dereference) with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N). It is not remotely exploitable and requires prior local code execution as a low-privileged user.

A public proof-of-concept by Valentina Palmiotti (chompie, IBM X-Force) and Ruben Boonen (b33f) is hosted on GitHub. Its README states the complete exploit works on vulnerable Windows 11 22H2 systems, while the write primitive works on all vulnerable systems. IBM X-Force published its analysis on 2023-03-21, and the PoC builds on public I/O Ring research by Yarden Shafir. IBM notes that all tested Windows 11 22H2 systems were vulnerable regardless of HVCI being enabled.

In January 2023, 360 IceSword Lab reported a different in-the-wild exploit sample for this flaw that uses the documented Winsock ProcessSocketNotifications interface rather than calling the driver directly. CISA's SSVC assessment (as of 2024-10-08) recorded exploitation as 'none' and technical impact as 'total'; the CVE is not listed in this research as a KEV entry. Microsoft fixed the issue in the January 2023 Patch Tuesday updates (afd.sys 10.0.22621.1105 for Windows 11 22H2, KB5022303).

Defenders should confirm January 2023 or later cumulative updates are installed on Windows 11 21H2/22H2 and Windows Server 2022, and hunt for unexpected low-privileged processes that suddenly run with SYSTEM integrity, or for the public PoC binary and its string artifacts. A third-party article (SentinelOne, May 2024) claims no patch exists; this conflicts with NVD, MSRC and IBM and was disregarded.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Execution

T1106 Native API

Privilege Escalation

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Defense Evasion

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Remediation for Windows afd.sys LPE

Patches

• Microsoft January 2023 Patch Tuesday (KB5022303 for Windows 11 22H2; afd.sys 10.0.22621.1105 or later)

Immediate actions

• Verify Windows 11 21H2/22H2 and Windows Server 2022 hosts have the January 2023 (or later) cumulative update installed
• Hunt for the public PoC binary name and unexpected low-privilege processes running as SYSTEM

Workarounds

• HVCI alone does not mitigate this flaw; patching is required

Longer-term hardening

• Enforce least privilege and application control to limit initial local code execution
• Deploy EDR with kernel-exploitation and token-manipulation behavioral detection

Affected and fixed versions

• Microsoft — Windows 11 version 22H2 (x64, ARM64)
  Vulnerable versions: before 10.0.22621.1105
  Fixed in: 10.0.22621.1105 (KB5022303)
• Microsoft — Windows 11 version 21H2 (x64, ARM64)
  Vulnerable versions: before 10.0.22000.1455
  Fixed in: 10.0.22000.1455
• Microsoft — Windows Server 2022 (x64)
  Vulnerable versions: before 10.0.20348.1487
  Fixed in: 10.0.20348.1487

Timeline of Windows afd.sys LPE

• 2023-01-01 360 IceSword Lab reports an in-the-wild exploit sample for the flaw using the Winsock locked-ioc-4 interface (January 2023; exact day not stated, first of month used)
• 2023-01-10 CVE-2023-21768 published to NVD with CVSS 3.1 base score 7.8 and CWE-822
• 2023-01-10 Microsoft fixes CVE-2023-21768 in January 2023 Patch Tuesday (locked-ioc-6 10.0.22621.1105, KB5022303 for Windows 11 22H2)
• 2023-03-21 IBM X-Force (Palmiotti, Boonen) publishes technical analysis of the flaw; the public PoC for Windows 11 22H2 is hosted on GitHub
• 2024-10-08 CISA SSVC assessment records exploitation as 'none' and technical impact as 'total' for CVE-2023-21768
• 2026-11-02 Cyber Security News publishes an article on the public PoC for the WinSock locked-ioc-6 privilege escalation

Sources cited for Windows afd.sys LPE

• NVD - CVE-2023-21768 NVD (NIST) · Advisory · 2023-01-10
• Microsoft MSRC - CVE-2023-21768 Microsoft Security Response Center · Vendor report · 2023-01-10
• IBM X-Force - Patch Tuesday, Exploit Wednesday: Pwning the Windows Ancillary Function Driver for WinSock (afd.sys) ibm.com · Research · 2023-03-21
• Root Cause Analysis - CVE-2023-21768 (STAR Labs patch diff) onlyfm252.starlabs.sg · Research
• AttackerKB - CVE-2023-21768 attackerkb.com · Research
• Rapid7 - CVE-2023-21768 AFD LPE module Rapid7 · Research
• chompie1337/Windows_LPE_AFD_CVE-2023-21768 (PoC repository) GitHub · Proof of concept
• POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability cybersecuritynews.com · News · 2026-11-02

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Previous and next in vulnerability

• ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link Previous report
• Structural Patch Gap from AI-Driven Vulnerability Discovery (Project Glasswing) - SOC Implications Next report