Skip to navigation

Threat reportVulnerabilityTL-2026-5950

SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

highACTIVE

Researcher Abdelhamid Naceri (Nightmare Eclipse / MSNightmare) published a public PoC for 'SignDrop', an unpatched, CVE-less Windows local privilege escalation that abuses CLFS authentication (.cnpf file creation in clfs.sys) via Microsoft Defender's signature-update RPC interface. Cyderes Howler Cell reproduced a standard-user to NT AUTHORITY\SYSTEM shell; no in-the-wild exploitation is confirmed and Microsoft has not commented.

Key facts

IdentifiersTL-2026-5950
Also known asSignDrop, SigDrop
SeverityHIGH
First disclosed
Affected productsMicrosoft Windows 11 (CLFS / clfs.sys, Microsoft Defender); Microsoft Windows Server 2025 (CLFS / clfs.sys, Microsoft Defender)
AttributionNightmare Eclipse (high confidence)
ToolsRoguePlanet, ShieldBreak, ShieldCrash, SignDrop
MITRE ATT&CK techniquesT1036.005 Masquerading: Match Legitimate Resource Name or Location, T1070.004 Indicator Removal: File Deletion, T1106 Native API, T1559 Inter-Process Communication, T1564.003 Hidden Window, T1574.001 Hijack Execution Flow: DLL
MotivationUNKNOWN
Target sectorstechnology, government administration, finance, health, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5950 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SignDrop - hid.dll or .cnpf Written to Common Files ink Directory (Exploitation)

Detects the SignDrop (SigDrop) CLFS/Defender LPE landing its payload: the exploit redirects a clfs.sys-created .cnpf authentication file via Object Manager symlinks so that C:\Program Files\Common Files\microsoft shared\ink\hid.dll is created with SYSTEM privileges, then overwrites it with the embedded IDR_DLL1 payload. Windows does not ship hid.dll in that directory (the legitimate copy is in System32), so any creation, modification or rename there is a high-fidelity exploitation indicator. Also covers ShieldBreak/ShieldCrash-style redirects that land files in the same directory. Requires Sysmon EventCode 11 (FileCreate) coverage of the ink directory; the exploit deletes hid.dll afterwards, so retain this telemetry.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1068, T1574.001, T1036.005
  • Data sources: sysmon (EventCode 11 FileCreate), Microsoft Defender for Endpoint DeviceFileEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h (TargetFilename="*\\microsoft shared\\ink\\hid.dll" OR TargetFilename="*\\microsoft shared\\ink\\*.cnpf")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files values(Image) as writer_images values(User) as users by host
| convert ctime(first_seen) ctime(last_seen)
| table host users writer_images files count first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath endswith @"\microsoft shared\ink"
| where FileName =~ "hid.dll" or FileName endswith ".cnpf"
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessAccountName

Sigma

title: SignDrop hid.dll or .cnpf Written to Common Files ink Directory
id: 3f6c1a52-8d47-4b9e-a1c3-5e7d2b9f0a14
status: experimental
description: Detects creation of hid.dll or a CLFS .cnpf authentication file in C:\Program Files\Common Files\microsoft shared\ink, the DLL-hijack landing spot used by the SignDrop CLFS/Defender local privilege escalation PoC (and shared by ShieldBreak/ShieldCrash-style symlink redirects).
references:
  - https://www.cyderes.com/howler-cell/signdrop-zero-day
  - https://github.com/MSNightmare/SignDrop
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1068
  - attack.t1574.001
  - attack.t1036.005
logsource:
  category: file_event
  product: windows
detection:
  selection_hid:
    TargetFilename|endswith: '\microsoft shared\ink\hid.dll'
  selection_cnpf:
    TargetFilename|contains: '\microsoft shared\ink\'
    TargetFilename|endswith: '.cnpf'
  condition: 1 of selection_*
falsepositives:
  - Third-party handwriting/ink or input-device software that legitimately installs a hid.dll into the ink directory
  - Microsoft Office or Windows servicing that repopulates the ink directory
level: high

Known false positives:

  • Third-party input/handwriting software that legitimately ships its own hid.dll or ink components into the ink directory
  • Windows or Office servicing/updates that repopulate files under Common Files\microsoft shared\ink

Tuning notes: Ensure the Sysmon config logs FileCreate for C:\Program Files\Common Files\microsoft shared\ink (do not exclude it for performance). Allow-list known software installers by Image/signer after a 30-day baseline. Any hid.dll in this directory written by a non-installer, non-TrustedInstaller process should be treated as exploitation. Adjust index/sourcetype to your Sysmon ingestion.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SignDrop - [indicator] Bait File Created Outside Defender Paths (Defender Signature-Update RPC Staging) · unlock with TL Creds
  • SignDrop - Hidden osk.exe Relaunch by Non-Standard Parent Followed by consent.exe (Setup / Hidden Window) · unlock with TL Creds
  • SignDrop - hid.dll Created Then Deleted in Common Files ink Directory (Anti-Forensic Cleanup) · unlock with TL Creds
  • SignDrop - mpasbase.vdm Definition File Created Outside Defender Directories (Symlink Redirect Artifact) · unlock with TL Creds
  • SignDrop - CLFS Authentication Registry Value Modified (Scope Change / Mitigation Tampering) · unlock with TL Creds
  • SignDrop - DNS Resolution of PoC Mirror Domains (Tool Acquisition) · unlock with TL Creds
  • SignDrop - consent.exe Loading DLL from Common Files ink Directory (Post-Exploitation Privilege Escalation) · unlock with TL Creds
  • SignDrop - SYSTEM conhost.exe Correlated with ink Directory hid.dll Write (Outcome / SYSTEM Shell) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5950.

Sample indicators (2 of 16)

  • Domain: git[.]projectnightcrawler[.]dev
  • Domain: git[.]churchofmalware[.]org

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

SignDrop is a logic-flaw local privilege escalation (no memory corruption) published on 2026-11-10, the same day as November 2026 Patch Tuesday, by the researcher Abdelhamid Naceri, who operates as Nightmare Eclipse (also tracked as MSNightmare, Chaotic Eclipse, Infinite Nightmare and Dead Eclipse). The PoC is hosted at github.com/MSNightmare/SignDrop with reported mirrors on git.projectnightcrawler.dev and git.churchofmalware.org. As of Cyderes reporting (2026-11-11) there is no CVE, no Microsoft patch and no Microsoft statement; SecurityWeek (2026-11-13) had also not received a Microsoft reply. No in-the-wild exploitation had been confirmed.

The flaw lies in how clfs.sys creates the CLFS authentication file (.cnpf) when a log file is created. Microsoft introduced CLFS log-file authentication (authentication codes verifying integrity) as a hardening against earlier CLFS memory-corruption bugs. Per SecurityWeek, opening a log file always opens its container; if the container is empty CLFS signs it whether or not a signature file exists. A standard user can create a CLFS log whose container path they control, then trigger Windows Defender through its signature update RPC interface (Proc42_ServerMpUpdateEngineSignature). Defender opens the file in the antimalware engine's SYSTEM context, and if the associated log is absent, a signature (.cnpf) file is created with SYSTEM privileges at an attacker-chosen location.

Exploit chain per Cyderes: (1) setup - the PoC kills and relaunches osk.exe hidden, creates %TEMP%\SigDrop_<GUID>, creates a CLFS log through the \CLFS prefix and builds GUID-named Object Manager symlinks under \BaseNamedObjects\Restricted\ that redirect the container and .cnpf paths; (2) product engagement - a DeviceIoControl to CLFS (IOCTL 0x8007A808) is issued (no .cnpf appearing means the host is not vulnerable), a bait MpEngine.dll is staged with an oplock and a worker thread calls Defender's Proc42_ServerMpUpdateEngineSignature, the oplock break signalling that Defender is engaged; (3) path redirect - the bait file is deleted, the update-directory symlink is repointed to \BaseNamedObjects\Restricted, a symlink mpasbase.vdm is pointed at the CLFS log and the .cnpf symlink is recreated to target hid.dll in C:\Program Files\Common Files\microsoft shared\ink; (4) privileged action - when Defender's SYSTEM operation triggers CLFS authentication, clfs.sys creates the .cnpf file, resolving to hid.dll in the ink directory; (5) outcome - the exploit overwrites the planted DLL with an embedded payload (resource IDR_DLL1) and calls ShellExecute with 'runas' on conhost.exe; AppInfo launches consent.exe as SYSTEM on the secure desktop, which (Cyderes' assessment) loads the planted hid.dll because osk.exe is running. The payload switches to WinSta0\Default, spawns a SYSTEM conhost.exe via CreateProcessW and terminates consent.exe; the exploit then waits about two seconds, kills osk.exe and transacted-deletes hid.dll, leaving little on disk.

Scope: the researcher tested Windows 11 26H2, Windows 11 26H2 Experimental and Windows Server 2025 Experimental, and claims roughly 80% of installations are affected ('generally vulnerable if your installation is older than 90 days'); Cyderes rates that estimate low confidence and unsubstantiated. Hosts whose HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication value is Mode 0 or Mode 1 are in scope, though the value alone does not prove exploitability. The release belongs to a cluster of Nightmare Eclipse Windows/Defender LPE drops (e.g. RoguePlanet/CVE-2026-50656, ShieldBreak, ShieldCrash); Cyderes notes the symlink-under-\BaseNamedObjects\Restricted detection also covers ShieldBreak and ShieldCrash. All releases in the cluster require an existing local foothold. Severity HIGH is an analyst estimate (no CVSS published): SYSTEM-level LPE with a public, reproduced PoC but local-only access required.

Defensive guidance: Cyderes advises inventorying the CLFS Authentication Mode value, not disabling CLFS authentication (which re-exposes older memory-corruption bug classes), restricting local code execution with application and script control, and deploying behaviour-based detections: Defender signature-update RPC from callers outside the Defender service tree, MpEngine.dll created outside Defender install paths, DeviceIoControl to CLFS from user processes, symlink creation/repointing under \BaseNamedObjects\Restricted\, any hid.dll creation in the ink directory, consent.exe loading DLLs from the ink directory, SYSTEM conhost.exe creation correlated with ink-directory writes, and transacted deletes there. Because the exploit deletes hid.dll, file-creation and image-load telemetry for the ink directory must be retained.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1564.003 Hidden Window; T1574.001 Hijack Execution Flow: DLL

Execution

T1106 Native API; T1559 Inter-Process Communication

stealth

T1574.001 Hijack Execution Flow: DLL

Remediation

Patches

  • No Microsoft patch or CVE as of 2026-11-13

Immediate actions

  • Inventory HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication (Mode 0/1) across the estate to define the detection-priority population
  • Deploy behaviour-based detections for Defender signature-update RPC from non-Defender callers, symlink activity under \BaseNamedObjects\Restricted\, hid.dll creation in C:\Program Files\Common Files\microsoft shared\ink, and consent.exe loading DLLs from that directory
  • Retain file-creation and image-load telemetry for the ink directory because the exploit transacted-deletes hid.dll

Workarounds

  • Do not disable CLFS authentication; it re-exposes older CLFS memory-corruption bug classes

Longer-term hardening

  • Restrict local code execution with application control and script control; every release in this cluster needs an existing foothold
  • Track Microsoft for a fix expected to change how CLFS resolves paths during .cnpf creation

Affected and fixed versions

  • Microsoft — Windows 11 (CLFS / clfs.sys, Microsoft Defender)
    Vulnerable versions: 26H2; 26H2 Experimental (researcher-tested)
  • Microsoft — Windows Server 2025 (CLFS / clfs.sys, Microsoft Defender)
    Vulnerable versions: Experimental build (researcher-tested)

Timeline

  • Microsoft publishes its CLFS hardening blog post (source of the figure that 19 of 24 CLFS CVEs were addressed by log-file authentication), the mitigation SignDrop later abuses, per Cyderes.
  • First Nightmare Eclipse exploit release, beginning the cluster of Windows/Defender LPE drops, per Cyderes.
  • Nightmare Eclipse drops the RoguePlanet Defender zero-day (later CVE-2026-50656); Microsoft acknowledges it 2026-06-16 and fixes it 2026-07-09, per press reporting.
  • Nightmare Eclipse releases ShieldBreak, a Defender SYSTEM LPE described as bypassing the CVE-2026-50656 fix; related ShieldCrash release follows the same pattern.
  • SignDrop PoC published on GitHub (MSNightmare/SignDrop) on November 2026 Patch Tuesday; no CVE or patch.
  • Cyderes Howler Cell compiles and reproduces SignDrop, obtaining a SYSTEM shell from a standard user; no in-the-wild exploitation observed and Microsoft has not commented.
  • SecurityWeek reports the SignDrop release and requests a Microsoft statement; no vendor response or patch published at the time.

Sources cited

More from Nightmare Eclipse

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats