# Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)

> On 2026-11-10 a researcher using the handle MSNightmare (Nightmare Eclipse) published a GitHub PoC named SignDrop for an unpatched local privilege escalation in the Windows Common Log File System driver (clfs.sys). The claimed bug abuses how CLFS creates .cnpf authentication files so that a privileged process (said to be Windows Defender) writes files in a SYSTEM context. No CVE, Microsoft advisory or patch exists and in-the-wild exploitation is not confirmed.

- **Published:** 2026-11-11T14:07:54Z
- **Last reviewed:** 2026-11-11T14:07:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5771
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5771.png
- **ID:** TL-2026-5771
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Actor:** MSNightmare
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2025-29824

## Description

SignDrop is a claimed local privilege escalation (LPE) in clfs.sys, the Windows Common Log File System kernel driver. The PoC was published on GitHub (github.com/MSNightmare/SignDrop, MIT license) on 2026-11-10 by the researcher MSNightmare, also known as Nightmare Eclipse. The repository describes it as a 'Windows Common Log FileSystem Authentication 0day Local Privilege Escalation Vulnerability'. As of 2026-11-11 there is no CVE, no Microsoft advisory or confirmation, and no patch. No independent testing and no in-the-wild exploitation have been reported; the claims below are the researcher's and are unverified.

Background: Microsoft introduced CLFS logfile authentication (KB5056852, Microsoft Learn 'CLFS Logfile Authentication') in updates released on or after 2025-10-28 for Windows 11 25H2, Windows 11 26H1 and Windows Server 2025. CLFS records HMACs, computed from logfile data and a system-unique key stored in the registry, in a reserved section of each logfile. If a logfile was not written by CLFS the open fails with ERROR_LOG_METADATA_CORRUPT (user mode) or STATUS_LOG_METADATA_CORRUPT (kernel mode). A new .cnpf 'patch file' is stored beside the .blf (for example example.blf.cnpf), is created with the same security attributes as the file it protects, and holds recovery data for logfiles that were not cleanly closed. After an update, CLFS runs in learning mode (Mode=1) and adds codes to existing logfiles on open, then moves to enforcement (Mode=0) after a 90-day adoption period (EnforcementTransitionPeriod) on the next driver start.

Claimed mechanism: per the researcher's README, the flaw is in how clfs.sys creates the .cnpf authentication files. Opening a base .blf also opens its associated container; if that container is empty, CLFS attempts to sign it even when no signature file exists. A privileged process, which the author says is Windows Defender, can be induced to open such a log through symbolic link manipulation (object manager symbolic links and file timing tricks, reachable through the exposed \CLFS device). The authentication file is then created in the privileged context, reportedly as SYSTEM and using the original file's DACL. The author says this can yield SYSTEM from a standard user and can be used to tamper with antivirus or EDR self-protection because the file creation request originates from the security product's own process. The repository includes SigDrop.cpp, a Visual Studio project, hid.dll and windefend.idl / windefend_c.c / windefend_h.h / windefend_s.c (Defender RPC interface stubs); the contents of the binaries were not verified.

Scope and caveats: the researcher states systems with HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode set to 0 (enforcement) or 1 (learning) are vulnerable, and Mode 2 or 3 (disabled) are not, and estimates about 80% of Windows installations are affected (unverified estimate). Tested versions per the researcher: Windows 11 26H2 (including Experimental) and Windows Server 2025 (Experimental). A third-party review cited by Cyber Security News reports the PoC does not work when CLFS authentication is disabled, found no independent test and no evidence of in-the-wild use, and did not run the code. Disabling the mitigation is not a viable workaround because it exposes the driver to other CLFS memory-corruption bugs. The attack vector is local: the attacker needs code execution as a normal user. A fix is expected through a future Patch Tuesday (the article's expectation, not a confirmed timeline).

Context: Nightmare Eclipse (also Chaotic Eclipse, Dead Eclipse) has released a series of Windows zero-day exploits since April 2026 (BlueHammer CVE-2026-33825, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, and others), several of which were reported as observed in real intrusions; Barracuda reports no coordinated disclosure and a personal grievance against Microsoft as the apparent motivation. Separately, CVE-2025-29824 (Storm-2460 / PipeMagic, patched 2025-04-08) was an earlier CLFS zero-day exploited for ransomware; it is a different, use-after-free flaw and is cited only for context. Public PoC availability for a kernel-adjacent SYSTEM LPE historically lowers the bar for post-compromise privilege escalation by ransomware and intrusion operators, so defenders should prepare monitoring now.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1106 Native API
- T1559 Inter-Process Communication
- T1588.005 Obtain Capabilities: Exploits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [SPL]** (`TL-2026-5771-SPL-001`)

Detects the key SignDrop (TL-2026-5771) artifact: a CLFS .cnpf authentication file created by a Microsoft Defender process (MsMpEng/MpCmdRun/NisSrv) or by any non-System process in a user-writable path. In normal operation the clfs.sys driver creates .cnpf files itself (Sysmon Image = System). The researcher-claimed exploit coerces a privileged Defender process into creating the file via symbolic link manipulation. Claims are unverified and no CVE or patch exists, so treat hits as hunt leads.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1211, T1106
- **Data sources:** sysmon, windows_file_events
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*.cnpf" earliest=-24h
| eval writer=lower(Image), target=lower(TargetFilename)
| eval defender_writer=if(match(writer,"(msmpeng|mpcmdrun|nissrv)\.exe$"),1,0)
| eval userland_path=if(match(target,"(users|temp|appdata|programdata)"),1,0)
| where defender_writer=1 OR (writer!="system" AND userland_path=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as cnpf_files values(User) as users by host, Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host Image users cnpf_files count first_seen last_seen
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName endswith ".cnpf"
| extend Writer = tolower(InitiatingProcessFileName), PathL = tolower(FolderPath)
| where Writer in ("msmpeng.exe", "mpcmdrun.exe", "nissrv.exe") or (Writer != "system" and PathL has_any ("users", "temp", "appdata", "programdata"))
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel, SHA256
```

### Sigma

```yaml
title: SignDrop CLFS .cnpf File Created by Defender or Non-System Process
id: 3b7e6c1a-5d24-4f0e-9a1b-7c2d8e4f5a61
status: experimental
description: Detects creation of CLFS authentication patch files (.cnpf) by Microsoft Defender processes or by non-System processes in user-writable paths, the artifact claimed for the SignDrop CLFS LPE (TL-2026-5771).
references:
    - https://github.com/MSNightmare/SignDrop
    - https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/clfs-authentication
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.defense-evasion
    - attack.t1211
    - attack.execution
    - attack.t1106
logsource:
    category: file_event
    product: windows
detection:
    selection_defender:
        Image|endswith:
            - '\MsMpEng.exe'
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
        TargetFilename|endswith: '.cnpf'
    selection_userland:
        TargetFilename|endswith: '.cnpf'
        TargetFilename|contains:
            - '\Users\'
            - '\Temp\'
            - '\AppData\'
            - '\ProgramData\'
    filter_kernel:
        Image: 'System'
    condition: selection_defender or (selection_userland and not filter_kernel)
falsepositives:
    - Defender scanning or remediating CLFS logfiles in user profile folders
    - Applications that legitimately create CLFS logs under user-writable paths
level: high
```

**Known false positives:**

- Defender legitimately scanning or remediating CLFS logfiles in user profile directories
- Applications that create their own CLFS logs (and .cnpf files) under user-writable paths such as AppData or ProgramData

**Tuning notes:** Baseline .cnpf creation for 7-14 days; confirm Sysmon FileCreate (EventCode 11) is enabled for *.cnpf and that kernel-created files show Image=System in your environment. Exclude known CLFS-using applications by Image and path. Prioritise hits where the writer is MsMpEng.exe and the target path is a user-writable or symlink-redirected location.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [KQL] (locked: unlock with TL Creds)
- SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [KQL] (locked: unlock with TL Creds)
- SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [KQL] (locked: unlock with TL Creds)
- SignDrop CLFS .cnpf Authentication File Written by Defender or Non-System Process (Exploitation) [Sigma] (locked: unlock with TL Creds)
- SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [Sigma] (locked: unlock with TL Creds)
- SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [Sigma] (locked: unlock with TL Creds)
- SignDrop CLFS Authentication Disabled or Tampered (Registry / fsutil clfs authenticate) [SPL] (locked: unlock with TL Creds)
- SignDrop PoC Tooling and Artifacts on Endpoint (SigDrop, windefend RPC stubs, rogue [indicator]) [SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Windows SignDrop 0-Day Exploit Lets Attackers Gain SYSTEM Privileges Through CLFS Protection](https://cybersecuritynews.com/windows-signdrop-zero-day-exploit/)
- [MSNightmare/SignDrop - GitHub repository (PoC)](https://github.com/MSNightmare/SignDrop)
- [SignDrop Windows CLFS Zero-Day Exploit Published, No Patch (Daily Security Review)](https://dailysecurityreview.com/resources/signdrop-windows-clfs-zero-day-exploit-published-no-patch/)
- [Common Log File System (CLFS) authentication mitigation (KB5056852)](https://support.microsoft.com/en-us/servicing/os/windows/2025/03/common-log-file-system-clfs-authentication-mitigation)
- [CLFS Logfile Authentication - Windows drivers (Microsoft Learn)](https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/clfs-authentication)
- [fsutil clfs (Microsoft Learn)](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-clfs)
- [Nightmare-Eclipse: six zero-days, six weeks and one big grudge (Barracuda)](https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge)
- [Exploitation of CLFS zero-day leads to ransomware activity (CVE-2025-29824, Microsoft)](https://microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity)
- [Windows exploit researcher suspended (Cyber Security News)](https://cybersecuritynews.com/windows-exploit-researcher-suspended/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5771