Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5771 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [SPL]

Detects the key SignDrop (TL-2026-5771) artifact: a CLFS .cnpf authentication file created by a Microsoft Defender process (MsMpEng/MpCmdRun/NisSrv) or by any non-System process in a user-writable path. In normal operation the clfs.sys driver creates .cnpf files itself (Sysmon Image = System). The researcher-claimed exploit coerces a privileged Defender process into creating the file via symbolic link manipulation. Claims are unverified and no CVE or patch exists, so treat hits as hunt leads.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1211, T1106
• Data sources: sysmon, windows_file_events
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*.cnpf" earliest=-24h
| eval writer=lower(Image), target=lower(TargetFilename)
| eval defender_writer=if(match(writer,"(msmpeng|mpcmdrun|nissrv)\.exe$"),1,0)
| eval userland_path=if(match(target,"(users|temp|appdata|programdata)"),1,0)
| where defender_writer=1 OR (writer!="system" AND userland_path=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as cnpf_files values(User) as users by host, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host Image users cnpf_files count first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName endswith ".cnpf"
| extend Writer = tolower(InitiatingProcessFileName), PathL = tolower(FolderPath)
| where Writer in ("msmpeng.exe", "mpcmdrun.exe", "nissrv.exe") or (Writer != "system" and PathL has_any ("users", "temp", "appdata", "programdata"))
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, SHA256

Sigma

title: SignDrop CLFS .cnpf File Created by Defender or Non-System Process
id: 3b7e6c1a-5d24-4f0e-9a1b-7c2d8e4f5a61
status: experimental
description: Detects creation of CLFS authentication patch files (.cnpf) by Microsoft Defender processes or by non-System processes in user-writable paths, the artifact claimed for the SignDrop CLFS LPE (TL-2026-5771).
references:
    - https://github.com/MSNightmare/SignDrop
    - https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/clfs-authentication
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.defense-evasion
    - attack.t1211
    - attack.execution
    - attack.t1106
logsource:
    category: file_event
    product: windows
detection:
    selection_defender:
        Image|endswith:
            - '\MsMpEng.exe'
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
        TargetFilename|endswith: '.cnpf'
    selection_userland:
        TargetFilename|endswith: '.cnpf'
        TargetFilename|contains:
            - '\Users\'
            - '\Temp\'
            - '\AppData\'
            - '\ProgramData\'
    filter_kernel:
        Image: 'System'
    condition: selection_defender or (selection_userland and not filter_kernel)
falsepositives:
    - Defender scanning or remediating CLFS logfiles in user profile folders
    - Applications that legitimately create CLFS logs under user-writable paths
level: high

Known false positives:

• Defender legitimately scanning or remediating CLFS logfiles in user profile directories
• Applications that create their own CLFS logs (and .cnpf files) under user-writable paths such as AppData or ProgramData

Tuning notes: Baseline .cnpf creation for 7-14 days; confirm Sysmon FileCreate (EventCode 11) is enabled for *.cnpf and that kernel-created files show Image=System in your environment. Exclude known CLFS-using applications by Image and path. Prioritise hits where the writer is MsMpEng.exe and the target path is a user-writable or symlink-redirected location.

• 🔒 SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [KQL] · unlock with TL Creds
• 🔒 SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [KQL] · unlock with TL Creds
• 🔒 SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [KQL] · unlock with TL Creds
• 🔒 SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [Sigma] · unlock with TL Creds
• 🔒 SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [Sigma] · unlock with TL Creds
• 🔒 SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [Sigma] · unlock with TL Creds
• 🔒 SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [SPL] · unlock with TL Creds
• 🔒 SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [SPL] · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5771.

Technical analysis

No CVE, Microsoft advisory or patch exists and in-the-wild exploitation is not confirmed.

SignDrop is a claimed local privilege escalation (LPE) in clfs.sys, the Windows Common Log File System kernel driver. The PoC was published on GitHub (github.com/MSNightmare/SignDrop, MIT license) on 2026-11-10 by the researcher MSNightmare, also known as Nightmare Eclipse. The repository describes it as a 'Windows Common Log FileSystem Authentication 0day Local Privilege Escalation Vulnerability'. As of 2026-11-11 there is no CVE, no Microsoft advisory or confirmation, and no patch. No independent testing and no in-the-wild exploitation have been reported; the claims below are the researcher's and are unverified.

Background: Microsoft introduced CLFS logfile authentication (KB5056852, Microsoft Learn 'CLFS Logfile Authentication') in updates released on or after 2025-10-28 for Windows 11 25H2, Windows 11 26H1 and Windows Server 2025. CLFS records HMACs, computed from logfile data and a system-unique key stored in the registry, in a reserved section of each logfile. If a logfile was not written by CLFS the open fails with ERROR_LOG_METADATA_CORRUPT (user mode) or STATUS_LOG_METADATA_CORRUPT (kernel mode). A new .cnpf 'patch file' is stored beside the .blf (for example example.blf.cnpf), is created with the same security attributes as the file it protects, and holds recovery data for logfiles that were not cleanly closed. After an update, CLFS runs in learning mode (Mode=1) and adds codes to existing logfiles on open, then moves to enforcement (Mode=0) after a 90-day adoption period (EnforcementTransitionPeriod) on the next driver start.

Claimed mechanism: per the researcher's README, the flaw is in how clfs.sys creates the .cnpf authentication files. Opening a base .blf also opens its associated container; if that container is empty, CLFS attempts to sign it even when no signature file exists. A privileged process, which the author says is Windows Defender, can be induced to open such a log through symbolic link manipulation (object manager symbolic links and file timing tricks, reachable through the exposed \CLFS device). The authentication file is then created in the privileged context, reportedly as SYSTEM and using the original file's DACL. The author says this can yield SYSTEM from a standard user and can be used to tamper with antivirus or EDR self-protection because the file creation request originates from the security product's own process. The repository includes SigDrop.cpp, a Visual Studio project, hid.dll and windefend.idl / windefend_c.c / windefend_h.h / windefend_s.c (Defender RPC interface stubs); the contents of the binaries were not verified.

Scope and caveats: the researcher states systems with HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode set to 0 (enforcement) or 1 (learning) are vulnerable, and Mode 2 or 3 (disabled) are not, and estimates about 80% of Windows installations are affected (unverified estimate). Tested versions per the researcher: Windows 11 26H2 (including Experimental) and Windows Server 2025 (Experimental). A third-party review cited by Cyber Security News reports the PoC does not work when CLFS authentication is disabled, found no independent test and no evidence of in-the-wild use, and did not run the code. Disabling the mitigation is not a viable workaround because it exposes the driver to other CLFS memory-corruption bugs. The attack vector is local: the attacker needs code execution as a normal user. A fix is expected through a future Patch Tuesday (the article's expectation, not a confirmed timeline).

Context: Nightmare Eclipse (also Chaotic Eclipse, Dead Eclipse) has released a series of Windows zero-day exploits since April 2026 (BlueHammer CVE-2026-33825, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, and others), several of which were reported as observed in real intrusions; Barracuda reports no coordinated disclosure and a personal grievance against Microsoft as the apparent motivation. Separately, CVE-2025-29824 (Storm-2460 / PipeMagic, patched 2025-04-08) was an earlier CLFS zero-day exploited for ransomware; it is a different, use-after-free flaw and is cited only for context. Public PoC availability for a kernel-adjacent SYSTEM LPE historically lowers the bar for post-compromise privilege escalation by ransomware and intrusion operators, so defenders should prepare monitoring now.

MITRE ATT&CK techniques by tactic:

Execution

T1106 Native API; T1559 Inter-Process Communication

Resource Development

T1588.005 Obtain Capabilities: Exploits

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• No patch or CVE available as of 2026-11-11; a fix is expected in a future Patch Tuesday per Cyber Security News

Immediate actions

• Keep CLFS logfile authentication enabled; do not set HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode to 2 as a workaround, because disabling it exposes CLFS to other memory-corruption bugs
• Restrict who can run code (interactive logon, RDP, remote shells, script execution) on high-value Windows 11 25H2/26H1/26H2 and Windows Server 2025 hosts
• Monitor for unexpected file creation by Microsoft Defender or other high-privilege processes, especially *.cnpf files created in unusual directories or via symbolic links
• Alert on unexpected CLFS errors such as ERROR_LOG_METADATA_CORRUPT / STATUS_LOG_METADATA_CORRUPT

Workarounds

• No vendor workaround; the researcher states none exists. Keeping CLFS authentication enabled (Mode 0 or 1) is the supported default but is itself the affected configuration per the researcher

Longer-term hardening

• Track Microsoft Security Response Center and Patch Tuesday for a CLFS fix and any CVE assigned to SignDrop
• Deploy EDR with kernel-driver and privilege-escalation behavioral detection and enable tamper protection for security products
• Enforce least privilege and tightly control standard user accounts and local code execution

Affected and fixed versions

• Microsoft — Windows 11 (CLFS logfile authentication builds)
  Vulnerable versions: 25H2; 26H1; 26H2 (tested by researcher)
• Microsoft — Windows Server 2025
  Vulnerable versions: Windows Server 2025 with updates released on or after 2025-10-28 (tested by researcher)

Timeline

• 2025-04-08 Microsoft patches CVE-2025-29824, an earlier CLFS use-after-free zero-day exploited by Storm-2460 with PipeMagic for ransomware; cited for context only, a different flaw from SignDrop
• 2025-10-28 Microsoft ships CLFS logfile authentication (HMAC and .cnpf patch files) in updates for Windows 11 25H2 and Windows Server 2025, with a 90-day learning-mode adoption period
• 2026-04-10 Huntress confirms in-the-wild exploitation of an earlier Nightmare Eclipse exploit, per Barracuda; unrelated to SignDrop but shows weaponization of this researcher's releases
• 2026-05-15 Microsoft states it is investigating the Nightmare Eclipse claims, per Barracuda's report on the exploit series
• 2026-11-10 MSNightmare publishes the SignDrop PoC to GitHub claiming SYSTEM LPE via CLFS .cnpf authentication file creation in a privileged Defender context
• 2026-11-11 Cyber Security News and Daily Security Review report SignDrop; no CVE, Microsoft advisory or patch, and no confirmed in-the-wild exploitation

Sources cited

• Common Log File System (CLFS) authentication mitigation (KB5056852) Microsoft · Vendor report · 2025-10-28
• CLFS Logfile Authentication - Windows drivers (Microsoft Learn) Microsoft · Vendor report · 2025-09-19
• fsutil clfs (Microsoft Learn) Microsoft · Vendor report · 2025-10-28
• Nightmare-Eclipse: six zero-days, six weeks and one big grudge (Barracuda) blog.barracuda.com · Research · 2026-05-19
• Exploitation of CLFS zero-day leads to ransomware activity (CVE-2025-29824, Microsoft) Microsoft · Vendor report · 2025-04-08
• MSNightmare/SignDrop - GitHub repository (PoC) GitHub · Proof of concept · 2026-11-10
• Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection cybersecuritynews.com · News · 2026-11-11
• SignDrop Windows CLFS Zero-Day Exploit Published, No Patch (Daily Security Review) dailysecurityreview.com · News · 2026-11-11
• Windows exploit researcher suspended (Cyber Security News) cybersecuritynews.com · News · 2026-01-01

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)
• Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)

More from MSNightmare

• Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)

Other reports on CVE-2025-29824

• CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks