Threat video1:00
CVE-2023-21768 Windows afd.sys LPE Flaw: Detection & IOCs
The public PoC gives local users SYSTEM on Windows 11 22H2 through afd.sys. Includes 9 detection rules (a free Splunk SPL one among them) and 6 IOCs.
Read the full threat intel for CVE-2023-21768 Windows afd.sys LPE Flaw: Detection & IOCs →
Chapters
- 0:00The hookWinsock kernel escalation: CVSS 7.8.
- 0:04The storyLocal kernel flaw in afd.sys reproduced.
- 0:11Attack pathStart with low-privileged local code execution.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise5 indicators to hunt: 1 URL and 4 file names.
- 0:39MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to privilege escalation.
- 0:44Remediation2 steps now: Verify Windows 11.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Winsock kernel escalation: CVSS 7.8.
0:05Local kernel flaw in afd.sys reproduced.
0:08Researchers released the PoC on GitHub.
0:11Start with low-privileged local code execution.
0:14Missing pointer validation in afd.sys.
0:17Attacker gains arbitrary kernel memory write.
0:20Then elevates the target process to SYSTEM.
0:23An in-the-wild variant attacked via ProcessSocketNotifications.
0:29No threat actor: this was defensive research.
0:345 indicators to hunt: 1 URL and 4 file names.
0:393 ATT&CK techniques, from initial access to privilege escalation.
0:442 steps now: Verify Windows 11.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.