New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections

New Windows zero-day 'SignDrop' allows local attackers to gain SYSTEM privileges by abusing CLFS.

A new Windows zero-day vulnerability named SignDrop allows local attackers to escalate privileges to SYSTEM by abusing the Common Log File System (CLFS) authentication mitigation. The flaw, discovered by Chaotic Eclipse, exploits a staged rollout of Microsoft's CLFS mitigation, leaving approximately 80% of Windows installations vulnerable if they are less than 90 days old or have the mitigation partially enabled. The exploit tricks Windows Defender into creating a signed authentication file with SYSTEM privileges.

AI summary of the linked source. Not reviewed by an editor. How this works