Threat video1:00
SignDrop CLFS 0-Day to SYSTEM: Exploitation Status & Fix
SignDrop gives local users SYSTEM through clfs.sys with a public PoC and no patch: 10 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for SignDrop CLFS 0-Day to SYSTEM: Exploitation Status & Fix →
Chapters
- 0:00The hookA claimed Windows flaw with no patch.
- 0:04The storyA researcher posted a claimed Windows flaw.
- 0:11Attack pathReported, a public PoC claiming local privilege escalation.
- 0:26AttributionAttributed to MSNightmare.
- 0:30Indicators of compromise6 indicators to hunt: 1 URL, 3 file names and 2 registry keys.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to defense impairment.
- 0:43Remediation4 steps now: Keep CLFS logfile authentication enabled.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A claimed Windows flaw with no patch.
0:05A researcher posted a claimed Windows flaw.
0:07The author names Defender.
0:11Reported, a public PoC claiming local privilege escalation.
0:15Defender is induced to open the log.
0:18A privileged file is created, claimed as SYSTEM.
0:21No CVE or patch exists yet.
0:26Attributed to MSNightmare. Confidence: medium.
0:316 indicators to hunt: 1 URL, 3 file names and 2 registry keys.
0:384 ATT&CK techniques, from resource development to defense impairment.
0:434 steps now: Keep CLFS logfile authentication enabled.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.