SignDrop PoC claims SYSTEM access through Windows CLFS authentication
Original title: New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Microsoft has not assigned a CVE or shipped a fix, and no real-world attacks have been reported.
Researcher MSNightmare published SignDrop, proof-of-concept code that claims a local Windows user can reach SYSTEM by redirecting creation of a CLFS companion file. The code abuses log authentication added to clfs.sys and, in the published chain, triggers Microsoft Defender's elevated update process with object-manager symbolic links. 78researchlab said a test succeeded but was not reliable enough for operational use. No SignDrop advisory or patch appeared in Microsoft's November updates.
Unconfirmed: Microsoft has not confirmed the flaw; 78researchlab says the exploit works but is not operationally reliable.
- The PoC was tested on Windows 11 26H2 and Windows Server 2025 Experimental builds.
- Claimed exposure is CLFS Authentication Mode 0 or 1; Mode 2 or 3 disables the check.
- Defender must be enabled for the published chain, and the attack changes every UAC prompt.
- A claim that any elevated antimalware engine is vulnerable has not been tested.
- The registry path to check is HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication.
Impact: Local user can obtain a writable SYSTEM file and a SYSTEM shell
| Product | Affected |
|---|---|
| Microsoft Windows CLFS (clfs.sys) | Tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental when Authentication Mode is 0 or 1 |
- 1.Check CLFS Authentication Mode at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication.
- 2.Do not set Mode to 2 or 3; that disables log authentication and reopens older CLFS flaws.
- 3.Watch Microsoft's security update guide for a CVE or patch.
- Vendors
- Microsoft
- Malware
- SignDrop
- Organizations
- 78researchlabCISA
From the original article
3 min read at thehackernews.com
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It abuses how clfs.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.