[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGpVYk6E2KumdPgIHZYkM0-HvPjxXh1SVdtkF0zBn80Y":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"5504244c-f18f-4d85-a65a-2f4a0cf2e1be","New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections","new-signdrop-exploit-can-abuse-windows-defender-to-bypass-security-protections-e80015","SignDrop is a Windows zero-day that abuses CLFS security protections to let local attackers gain SYSTEM privileges and bypass defenses. The researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, Nightmare-Eclipse, and MSNightmare, published a proof-of-concept for a new Windows local privilege escalation zero-day, naming it SignDrop. The flaw sits inside the mitigation Microsoft rolled out […]","A new Windows zero-day vulnerability named SignDrop allows local attackers to escalate privileges to SYSTEM by abusing the Common Log File System (CLFS) authentication mitigation. The flaw, discovered by Chaotic Eclipse, exploits a staged rollout of Microsoft's CLFS mitigation, leaving approximately 80% of Windows installations vulnerable if they are less than 90 days old or have the mitigation partially enabled. The exploit tricks Windows Defender into creating a signed authentication file with SYSTEM privileges.","New Windows zero-day 'SignDrop' allows local attackers to gain SYSTEM privileges by abusing CLFS.","https:\u002F\u002Fsecurityaffairs.com\u002F202968\u002Fhacking\u002Fnew-signdrop-exploit-can-abuse-windows-defender-to-bypass-security-protections.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-26.png","2026-11-13T09:02:00+00:00","2026-11-13T10:00:39.947297+00:00",9,[17,20,23,25],{"name":18,"type":19},"Windows Defender","product",{"name":21,"type":22},"CLFS","technology",{"name":24,"type":19},"Windows",{"name":26,"type":27},"Chaotic Eclipse","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,24],{"controls":54,"vendors":138},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":85,"product_name":106,"url":107,"description":108},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[139],{"slug":123,"name":124,"logo_path":125,"roles":140},[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"windows-zero-day-exploits-staged-rollout-gap-to-escalate-privileges-to-system","Windows Zero-Day Exploits Staged Rollout Gap to Escalate Privileges to SYSTEM","The SignDrop vulnerability exposes a dangerous window created by Microsoft's phased rollout of the CLFS authentication mitigation, leaving approximately 80% of Windows systems vulnerable during the transition period. Attackers can abuse Windows Defender itself — a trusted security component — to forge a signed authentication file with SYSTEM privileges, turning a defensive tool into an attack vector. This highlights how partial or staged security mitigations can introduce new attack surfaces rather than closing them. The 90-day vulnerability window between mitigation deployment phases gives adversaries ample time to exploit systems that are neither fully protected nor fully unprotected.",[147,148,149,150,151],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 7: Continuous Vulnerability Management (v8)":155,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":156,"CIS Control 2: Inventory and Control of Software Assets (v8)":157},"This point covers vulnerability handling and disclosure in acquisition and maintenance, directly applicable to managing the risk introduced by Microsoft's incomplete mitigation deployment across in-scope systems.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; enforcing a maximum remediation window would close the 90-day gap the exploit depends on.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; proactive scanning would have identified systems still within the vulnerable CLFS mitigation window before attackers could exploit them.","SignDrop directly implements this technique by exploiting a vulnerability in the CLFS subsystem to escalate from local user to SYSTEM privileges.","Knowing which OS versions and patch states are deployed across the estate is prerequisite to identifying the ~80% of installations left vulnerable by the staged mitigation rollout."]