# Public PoC for Windows Ancillary Function Driver for WinSock (afd.sys) Privilege Escalation - CVE-2023-21768

> CVE-2023-21768 is a local privilege escalation flaw in afd.sys (Windows Ancillary Function Driver for WinSock) caused by missing pointer validation in a kernel code path. A public PoC by Valentina Palmiotti (chompie) and Ruben Boonen targets Windows 11 22H2. Microsoft patched the flaw in January 2023, and 360 IceSword Lab reported a separate in-the-wild exploit sample the same month.

- **Published:** 2026-11-02T12:07:28Z
- **Last reviewed:** 2026-11-02T12:07:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5053
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5053.png
- **ID:** TL-2026-5053
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2023-21768

## Description

CVE-2023-21768 is a local elevation-of-privilege vulnerability in afd.sys, the Windows Ancillary Function Driver for WinSock. The root cause, per public patch-diff analysis, is a missing user-pointer validation (PreviousMode check without a probe) in afd!AfdNotifyRemoveIoCompletion, which allows a low-privileged local user to cause a kernel memory write. NVD classifies it as CWE-822 (Untrusted Pointer Dereference) with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N). It is not remotely exploitable and requires prior local code execution as a low-privileged user.

A public proof-of-concept by Valentina Palmiotti (chompie, IBM X-Force) and Ruben Boonen (b33f) is hosted on GitHub. Its README states the complete exploit works on vulnerable Windows 11 22H2 systems, while the write primitive works on all vulnerable systems. IBM X-Force published its analysis on 2023-03-21, and the PoC builds on public I/O Ring research by Yarden Shafir. IBM notes that all tested Windows 11 22H2 systems were vulnerable regardless of HVCI being enabled.

In January 2023, 360 IceSword Lab reported a different in-the-wild exploit sample for this flaw that uses the documented Winsock ProcessSocketNotifications interface rather than calling the driver directly. CISA's SSVC assessment (as of 2024-10-08) recorded exploitation as 'none' and technical impact as 'total'; the CVE is not listed in this research as a KEV entry. Microsoft fixed the issue in the January 2023 Patch Tuesday updates (afd.sys 10.0.22621.1105 for Windows 11 22H2, KB5022303).

Defenders should confirm January 2023 or later cumulative updates are installed on Windows 11 21H2/22H2 and Windows Server 2022, and hunt for unexpected low-privileged processes that suddenly run with SYSTEM integrity, or for the public PoC binary and its string artifacts. A third-party article (SentinelOne, May 2024) claims no patch exists; this conflicts with NVD, MSRC and IBM and was disregarded.

## MITRE ATT&CK

- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1106 Native API
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SYSTEM Shell or Tool Spawned by Non-SYSTEM Parent — Post-Exploitation Token Theft** (`TL-2026-5053-SPL-002`)

Detects the post-exploitation outcome of CVE-2023-21768: a low-privileged user process whose token becomes SYSTEM and spawns cmd, PowerShell, whoami or similar tooling. This is the primary behavioural indicator named in the research (low-privileged process acquiring a SYSTEM token) and is independent of binary name.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1134.001, T1068, T1078, T1059.003
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where isnotnull(ParentUser) AND match(User,"(?i)system$") AND NOT match(ParentUser,"(?i)(system|local service|network service)$")
| where match(Image,"(?i).(cmd|powershell|pwsh|whoami|net1?|wmic|reg|sc|mshta|rundll32|cscript|wscript)[.]exe$")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_cmd by host, ParentUser, ParentImage, User, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountSid == "S-1-5-18"
| where isnotempty(InitiatingProcessAccountSid) and InitiatingProcessAccountSid !in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "net1.exe", "wmic.exe", "reg.exe", "sc.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: SYSTEM Shell or Tool Spawned by Non-SYSTEM Parent Process
id: 5b0e7c1a-3d52-4a6e-9f10-5053a0000002
status: experimental
description: Detects a SYSTEM-context shell or recon utility whose parent process runs as a regular user, the typical outcome of kernel token theft such as CVE-2023-21768.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-21768
    - https://www.ibm.com/think/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock
    - https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.privilege_escalation
    - attack.t1134.001
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - attack.initial_access
    - attack.t1078
    - cve.2023.21768
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        User:
            - 'NT AUTHORITY\SYSTEM'
            - 'AUTORITE NT\SYSTEM'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\wmic.exe'
            - '\reg.exe'
            - '\sc.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    filter_system_parent:
        ParentUser|contains:
            - 'AUTHORITY\SYSTEM'
            - 'AUTHORITY\LOCAL SERVICE'
            - 'AUTHORITY\NETWORK SERVICE'
            - 'AUTORITE NT\SYSTEM'
    condition: selection and not filter_system_parent
falsepositives:
    - Remote management agents that impersonate a user session before launching SYSTEM tasks
    - Authorized use of PsExec -s or similar from an elevated admin session
level: high

```

**Known false positives:**

- Admin tooling (PsExec -s, RMM agents) launching SYSTEM shells from a user session
- Installer bootstrappers that elevate to SYSTEM through legitimate services

**Tuning notes:** Requires Sysmon 13 or later for ParentUser. Allowlist approved RMM and deployment parents by ParentImage. Correlate with interactive or RDP logons for the same user within 30 minutes to raise fidelity, and weight hits on Windows 11 22H2 and Server 2022 hosts missing KB5022303.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unsigned User-Writable Launcher With Single PID Argument — Exploitation (locked: unlock with TL Creds)
- Integrity Level Jump to SYSTEM From User-Context Parent — Post-Exploitation (locked: unlock with TL Creds)
- Proxy or Endpoint Access to chompie1337 PoC Repository — Tool Transfer (locked: unlock with TL Creds)
- CVE-2023-21768 Public PoC Binary Name or Command Line — Exploitation (locked: unlock with TL Creds)
- SYSTEM Shell Spawned From User-Writable Parent Path — Post-Exploitation (locked: unlock with TL Creds)
- Command-Line Download of chompie1337 PoC — Tool Transfer (locked: unlock with TL Creds)
- CVE-2023-21768 [indicator] LPE PoC Execution or Launcher Pattern — Exploitation (locked: unlock with TL Creds)
- PoC Download From chompie1337 GitHub Repository — Tool Transfer (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability](https://cybersecuritynews.com/poc-for-windows-winsock-ancillary-vulnerability/)
- [NVD - CVE-2023-21768](https://nvd.nist.gov/vuln/detail/CVE-2023-21768)
- [Microsoft MSRC - CVE-2023-21768](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21768)
- [IBM X-Force - Patch Tuesday, Exploit Wednesday: Pwning the Windows Ancillary Function Driver for WinSock (afd.sys)](https://www.ibm.com/think/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock)
- [chompie1337/Windows_LPE_AFD_CVE-2023-21768 (PoC repository)](https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768)
- [Root Cause Analysis - CVE-2023-21768 (STAR Labs patch diff)](https://onlyfm252.starlabs.sg/data/patch_diffs/rca-cve-2023-21768.md)
- [AttackerKB - CVE-2023-21768](https://attackerkb.com/topics/cve-2023-21768)
- [Rapid7 - CVE-2023-21768 AFD LPE module](https://www.rapid7.com/db/vulnerabilities/exploit/windows/local/cve_2023_21768_afd_lpe)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5053