SignDrop PoC exploits Windows CLFS to seek SYSTEM access

A new Windows privilege‑escalation technique, named SignDrop, has been disclosed by a public exploit author claiming to deliver SYSTEM access via the Common Log File System (CLFS) driver. The PoC targets the log authentication feature that Microsoft added to CLFS last year, leveraging how clfs.sys creates a companion .cnpf recovery file alongside each log.

By using path redirection, the exploit aims to cause the driver to create the .cnpf file in the security context of a privileged process instead of the user, thereby enabling a writeable SYSTEM file. The published proof‑of‑concept code, attributed to the researcher going by MSNightmare, describes abusing object manager symbolic links to redirect file creation to a location of the attacker’s choosing. In demonstrations, the privileged process used is Defender’s antimalware service, invoked via its update interface. Microsoft has not publicly confirmed the flaw, assigned a CVE, or issued a patch as of the report.

Independent testing by Sungyup Nam, head of research at 78researchlab, citing a PurpleHound researcher’s assessment, indicates SignDrop works in controlled tests but does not appear reliable enough for operational use yet. The exploit reportedly requires Defender to be enabled to chain the privilege escalation, and changes prompt a SYSTEM shell that could alert operators. The article notes there is no CVE in the November Microsoft updates, and CISA’s Known Exploited Vulnerabilities catalog does not list SignDrop.

Exposure can be checked by examining HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication Mode, with values 0 or 1 within the scope claimed by researchers.