SignDrop Windows Zero-Day Exploit Abuses Defender to Bypass Security Protections and Escalate Privileges

Entenda a falha

A vulnerabilidade

SignDrop is an unpatched local privilege escalation zero-day in the Windows Common Log File System (clfs.sys), with no CVE assigned. A standard local user who can create CLFS log files can trick a privileged process, such as Windows Defender, into opening them, and gets SYSTEM privileges. The same trick can be pointed at other antimalware engines to bypass self-defense and tamper protection. The researcher says about 80% of Windows installs are exposed, namely those where the CLFS authentication mitigation is still in learning mode or only partly enabled (registry Mode value 0 or 1; 2 or 3 is protected). The PoC was tested on Windows 11 26H2 and Windows Server 2025 Experimental builds. No fix exists yet.

Como funciona

When a CLFS log file has an associated container, opening the original file also opens the linked file. If that linked file is empty, CLFS tries to sign it, creating a .cnpf authentication file, whether or not a signature already exists. When the caller creates its own files, CLFS enforces access checks in the caller's context. The problem appears when a more privileged process opens the prepared file instead. According to the researcher, Defender is driven to do this through ServerMpUpdateEngineSignature and changes to symbolic links in the Object Manager. Defender follows the path stored in the original container, finds the unsigned associated file and creates the signature file with SYSTEM privileges. CLFS then builds that file using the original file's DACL.

Por que é vulnerável

The researcher attributes the flaw to a logic issue in the staged rollout of the CLFS authentication mitigation, not to a classic memory bug. CLFS signs an empty associated file regardless of who opened it, and anyone who knows the path can open a log file, so a privileged process can be made to act on attacker-prepared files. The researcher says Microsoft did everything properly but the logic allows abuse, and that the mitigation is turned against itself. Because the file creation appears to come from the antivirus's own legitimate process, its kernel drivers let it pass. Disabling the mitigation removes the path but reopens CLFS memory corruption bugs. A fix is not yet available.

Onde está

The articles place the bug in clfs.sys, in how the driver creates the .cnpf authentication file tied to a new log container; the Defender-side trigger uses ServerMpUpdateEngineSignature. The configuration is the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode.

Como foi descoberta

The researcher Chaotic Eclipse (also known as Nightmare-Eclipse, who says he is Abdelhamid Naceri) disclosed SignDrop publicly, releasing the PoC code and a technical write-up on GitHub. The articles do not describe a prior report to Microsoft or any coordinated disclosure. They say he regularly releases Microsoft zero-days publicly, often after criticizing vendors' handling of reports, and that some earlier releases were later exploited in the wild. Microsoft rolled out the CLFS authentication mitigation on October 28, 2025, with a 90-day learning phase.

Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 08:16.