Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation

Key facts for TL-2026-5208

Detection coverage for TL-2026-5208

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5208 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MiniPlasma / CVE-2020-17103 cldflt.sys Registry Key Creation in HKU\.DEFAULT by User-Writable Process

Detects the behavioural footprint of the MiniPlasma Cloud Filter driver (cldflt.sys) local privilege escalation (CfAbortHydration abuse, related to CVE-2020-17103): a non-SYSTEM process running from a user-writable path (Users, ProgramData, Temp) creating or setting keys under HKEY_USERS\.DEFAULT, which the exploit reaches without access checks before obtaining SYSTEM. Behaviour-first; requires Sysmon registry events (EventCode 12/13).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1112, T1211
• Data sources: sysmon, windows_registry
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12,13) TargetObject="HKU\\.DEFAULT\\*" NOT User="NT AUTHORITY\\SYSTEM"
| eval img=lower(Image)
| where match(img, "\\\\(users|programdata|temp)\\\\") AND NOT match(img, "\\\\microsoft\\\\onedrive\\\\")
| stats count min(_time) as first_seen max(_time) as last_seen values(EventType) as event_types values(TargetObject) as registry_keys by host, User, Image, ProcessGuid
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryKeyCreated", "RegistryValueSet")
| where RegistryKey startswith @"HKEY_USERS\.DEFAULT\"
| where InitiatingProcessAccountName !~ "system"
| where InitiatingProcessFolderPath matches regex @"(?i)\\(Users|ProgramData|Temp)\\"
| where InitiatingProcessFolderPath !contains @"\Microsoft\OneDrive\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName

Sigma

title: MiniPlasma CVE-2020-17103 Registry Write in HKU DEFAULT by User-Writable Process
id: 3b7f1c52-8a1e-4d6b-9c42-5e0a7d1f2b01
status: experimental
description: Detects a non-SYSTEM process in a user-writable path creating or setting registry keys under HKU\.DEFAULT, the behaviour of the MiniPlasma cldflt.sys CfAbortHydration privilege escalation.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17103
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.defense-evasion
    - attack.t1112
    - attack.t1211
    - attack.tool.miniplasma
    - cve.2020-17103
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|startswith: 'HKU\.DEFAULT\'
        EventType:
            - 'CreateKey'
            - 'SetValue'
        Image|contains:
            - '\Users\'
            - '\ProgramData\'
            - '\Temp\'
    filter_system:
        User: 'NT AUTHORITY\SYSTEM'
    filter_onedrive:
        Image|contains: '\Microsoft\OneDrive\'
    condition: selection and not 1 of filter_*
falsepositives:
    - Software installers or per-user tools that legitimately write default-profile settings
    - Profile or logon-script tooling run from user-writable paths
level: high

Known false positives:

• Per-user installers or profile-management tools running from Temp/ProgramData that seed HKU\.DEFAULT settings
• Endpoint/IT tooling executed from a user profile that writes default-profile registry values

Tuning notes: Baseline 14 days of EventCode 12/13 under HKU\.DEFAULT and allow-list signed installer and profile-tool Image paths. Pair alerts with SPL-002 (SYSTEM shell from the same parent) to raise confidence. Not yet tested against a live MiniPlasma run; kernel-side key creation attribution to the calling Image should be confirmed in a lab.

• 🔒 Server-Side RCE Exploitation: Web/Application Server Worker Spawning Shell or Script Host (T1190) · unlock with TL Creds
• 🔒 Client-Side RCE Exploitation: Office, PDF Reader or Browser Spawning Shell or Script Host (T1203) · unlock with TL Creds
• 🔒 Cloud Files API (cldapi.dll) Loaded by Non-Sync-Provider Process in User-Writable Path - MiniPlasma CfAbortHydration Surface · unlock with TL Creds
• 🔒 CLFS Privilege Escalation Staging: Non-System Process Creating .blf Log Files in User-Writable Paths ([indicator]) · unlock with TL Creds
• 🔒 Post-Exploitation Default-Hive Tampering: SYSTEM Shell Modifying HKU\.DEFAULT After Local Privilege Escalation (T1112) · unlock with TL Creds
• 🔒 MiniPlasma PoC Execution: Process Image or Command Line Referencing MiniPlasma / CfAbortHydration · unlock with TL Creds
• 🔒 SYSTEM Shell Spawned by User-Writable-Path Parent (LPE Outcome, CVE-2020-17103 / CVE-2025-62221 class) · unlock with TL Creds
• 🔒 MiniPlasma PoC Acquisition: Download Artifact Referencing Nightmare-Eclipse / MiniPlasma (T1588.006, T1105) · unlock with TL Creds

Indicators of compromise for TL-2026-5208

As of 2026-11-04, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5208.

How Microsoft Analysis works

On 2026-11-02 Microsoft Security Research published 'What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks'. The study covers CVEs published through September 2026 from Microsoft's tracked vulnerability catalog, correlated with CISA KEV data, CVE.org metrics and VulnCheck's State of Exploitation 2026 research. Each CVE is counted once by impact class across Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts and developer packages. Of roughly 383,000 published CVEs only about 2,000 (~0.5%, fewer than 1 in 200) are linked to real-world exploitation, and 78% of exploited CVEs (1,239 remote-takeover CVEs analyzed) give attackers system takeover or privilege escalation.

The exploited population differs sharply from the published population. Server-side RCE is 20% of published CVEs but 37% of exploited; local privilege escalation 11% vs 18%; client-side RCE 4% vs 13%; OS vulnerabilities 23% vs 41% of exploited (77% of all CVEs are in application code, 23% in OS code). Cross-site scripting (15% to 4%) and denial of service (16% to 7%) are under-represented among exploited CVEs. Microsoft notes that a vulnerability's stated classification does not always reflect what an attacker can reliably achieve in practice.

Time-to-exploitation is shrinking: 29% of 2025 exploits launched within one day of CVE publication. Mean time from CVE publication to CISA KEV listing fell from 89 days (2024) to 57 days (2025) to 20 days (2026 through September), with a 2026 median of 3 days. Median patch times lag attackers: about 2 weeks for Windows workstations, over 1 month for Windows servers, over 10 weeks for Linux servers and macOS applications, and over 1 year for network appliances.

The coverage cites Windows local privilege-escalation examples: a Windows CLFS driver flaw, the MiniPlasma zero-day and a Cloud Files driver zero-day. Per secondary reporting, MiniPlasma is a public PoC by researcher Chaotic Eclipse (Nightmare-Eclipse) abusing the Cloud Filter driver (cldflt.sys) CfAbortHydration API to create a registry key in the .DEFAULT user hive without access checks, yielding SYSTEM on fully patched Windows 11 (May 2026 updates); it is tied to CVE-2020-17103, originally reported by James Forshaw in September 2020. A separate cldflt.sys flaw, CVE-2025-62221, was patched in December 2025 after in-the-wild exploitation. This is trend-level vendor research: no threat actor, malware family, campaign or network IOCs are named in the primary source, so no BeaconBeagle correlation was applicable.

Microsoft's guidance: prioritize takeover vulnerabilities (server-side RCE, authentication bypass, local privilege escalation); discover internet-facing assets with external attack surface management; rank remediation beyond CVSS using threat signals, breach likelihood, exposure and asset criticality; and use attack path analysis to break attack chains before they reach sensitive resources.

MITRE ATT&CK techniques by tactic:

defense-impairment

T1112 Modify Registry

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Resource Development

T1588.006 Obtain Capabilities: Vulnerabilities

Remediation for Microsoft Analysis

Patches

• Apply vendor security updates promptly; 29% of 2025 exploits launched within one day of CVE publication
• Monitor the CISA KEV catalog and apply remediation by its due dates

Immediate actions

• Prioritize patching vulnerabilities that enable system takeover: server-side RCE, authentication/authorization bypass and local privilege escalation
• Identify internet-facing assets with external attack surface management (e.g., Microsoft Defender External Attack Surface Management)
• Treat Windows privilege-escalation flaws in drivers such as CLFS and Cloud Files (cldflt.sys) as high priority

Workarounds

• Restrict exposure of server-side services and network appliances until patched
• Limit local access and standard-user footholds to reduce local privilege-escalation impact

Longer-term hardening

• Rank vulnerabilities beyond CVSS using exploit signals, breach likelihood, internet exposure and asset criticality
• Use attack path analysis to find routes from exposed servers to sensitive data and break attack chains
• Shorten patch cycles for Windows servers, Linux/macOS systems and network appliances, which lag workstation patching

Affected and fixed versions

• Microsoft — Windows (CLFS driver, Cloud Files/Cloud Filter driver cldflt.sys)
  Vulnerable versions: Windows 11 fully patched as of May 2026 (MiniPlasma, per secondary reporting)
• Multiple — Applications, operating systems, network appliances, IoT/OT, virtualization hosts and developer packages (trend-level analysis)

Timeline of Microsoft Analysis

• 2020-09-01 Cloud Filter driver (locked-ioc-7) registry-manipulation flaw reported to Microsoft by Google Project Zero's James Forshaw (month precision, September 2020).
• 2020-12-01 Microsoft addresses the issue as CVE-2020-17103 in December 2020 updates (month precision); locked-ioc-6's author later claims the same issue remained unpatched.
• 2025-12-01 Microsoft patches CVE-2025-62221, a separate locked-ioc-7 privilege escalation flaw confirmed exploited in the wild (month precision, December 2025).
• 2026-05-01 Researcher locked-ioc-5 publicly releases the locked-ioc-6 PoC, giving SYSTEM on fully patched Windows 11 with May 2026 updates (month precision).
• 2026-09-30 Cutoff of the CVE and exploitation data used in Microsoft's analysis (CVEs published through September 2026).
• 2026-11-02 Microsoft Security Blog publishes the data-driven analysis: 78% of exploited CVEs enable system takeover or privilege escalation.
• 2026-11-03 Cyber Security News reports the findings, citing the CLFS, locked-ioc-6 and Cloud Files driver examples.

Sources cited for Microsoft Analysis

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-03
• NVD - CVE-2020-17103 NVD (NIST) · Advisory
• NVD - CVE-2025-62221 NVD (NIST) · Advisory
• What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks (Microsoft Security Blog) Microsoft · Vendor report · 2026-11-02
• VulnCheck State of Exploitation 1H 2026 vulncheck.com · Research
• MiniPlasma: Windows privilege escalation zero-day affects fully patched systems (ThreatLocker) threatlocker.com · Blog
• Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation (Cyber Security News) cybersecuritynews.com · News · 2026-11-03
• New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released (BleepingComputer) BleepingComputer · News
• MiniPlasma Windows 0-Day Enables SYSTEM (The Hacker News) The Hacker News · News

More in vulnerability

• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)
• Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)
• Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices
• Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets (LND macaroon credential exposure)