Threat video1:00
SignDrop CLFS Zero-Day to SYSTEM: Detection & IOCs
The public PoC abuses CLFS .cnpf file creation to reach SYSTEM on unpatched Windows. Hunt it with 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege… →
Chapters
- 0:00The hookUnpatched Windows flaw.
- 0:04The storyA proof-of-concept hit GitHub.
- 0:10Attack pathReportedly, systems with CLFS authentication enabled are exposed.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise7 indicators to hunt: 5 file names, 1 registry key and 1 path.
- 0:39MITRE ATT&CK techniques5 ATT&CK techniques, from execution to defense impairment.
- 0:43Remediation5 steps now: Do not disable CLFS authentication.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Unpatched Windows flaw. No CVE. No patch.
0:05A proof-of-concept hit GitHub.
0:07Reportedly, it lets standard users obtain SYSTEM.
0:11Reportedly, systems with CLFS authentication enabled are exposed.
0:16Standard-user code is required; no remote access.
0:20Reported chain ends in a SYSTEM shell.
0:22Microsoft has not confirmed the claims; no patch exists.
0:29No threat actor: this was defensive research.
0:337 indicators to hunt: 5 file names, 1 registry key and 1 path.
0:395 ATT&CK techniques, from execution to defense impairment.
0:445 steps now: Do not disable CLFS authentication.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.