"Everything is done properly by Microsoft here but the logic allows abuse," wrote the researcher who publishes under the name MSNightmare after releasing proof-of-concept code that claims a local Windows user can elevate to SYSTEM via the Common Log File System driver.
What SignDrop claims to do against CLFS authentication
The published proof-of-concept, called SignDrop, targets a log-authentication feature added to the CLFS driver in October 2025 updates for Windows 11 25H2, 26H1, and Windows Server 2025. That feature attaches a hash-based message authentication code (HMAC) to log data using a key unique to each machine so the driver parses only log files it wrote. A companion recovery file with a .cnpf extension is created beside each log and — according to Microsoft's logfile authentication page cited by the researcher — is created with the same security attributes as the original log.
SignDrop, the researcher says, abuses how clfs.sys creates that companion .cnpf file when a privileged process later opens a prepared log. By preparing a CLFS log and container with paths the standard user controls, then using object manager symbolic links, the researcher’s code redirects the driver's creation of the .cnpf file into a location of the attacker's choosing. Because the driver creates the .cnpf file in the privileged process's security context and the .cnpf file inherits the original log's permissions, the researcher says the result is a writable file created as SYSTEM that a standard user can then leverage into a SYSTEM shell.
Chain, scope, and the role of antimalware
The published exploit chain uses an elevated antimalware process as the privileged actor that opens the prepared log; in the repository the researcher uses the Defender antimalware service, triggered via its update interface. The repository further claims the technique can work against any antimalware engine whose process runs with elevated privileges, but that broader claim has not been tested, the source notes.
SignDrop was tested against Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental, according to the repository. Systems are within the researcher’s claimed attack surface when the CLFS authentication registry mode at HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication has a Mode value of 0 (enforced) or 1 (learning). The researcher notes that systems older than 90 days typically move from learning to enforcement automatically, making the default configuration on established installations the one targeted by the exploit.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIndependent test and operational reliability
Independent assessment published today by Sungyup Nam, head of research at Korean security firm 78researchlab, reproduces the exploit and reports that Heewon Song of 78researchlab’s PurpleHound offensive content team found the exploit works. Nam recorded Song’s assessment that the method does not run reliably enough for operational use.
78researchlab’s report also emphasizes operational constraints: Defender must be enabled for the published chain to succeed, and running the exploit causes every UAC prompt to open both a standard user shell and a SYSTEM shell, which blocks other actions and makes the attack observable on the local machine. Those practical effects make the technique noisy and detectable during active use.
Where SignDrop stands in vendor catalogs and past alerts
No CVE, official advisory, or patch for SignDrop appeared in Microsoft’s November security updates, and the CISA Known Exploited Vulnerabilities catalog does not list SignDrop. The researcher’s repository includes a detailed writeup and public exploit code released on GitHub on Tuesday, the same day Microsoft published its November updates, but no attacks using SignDrop have been reported.
The researcher has published several Defender-targeting exploits since April. Microsoft previously confirmed one such Defender exploit called RoguePlanet in June as CVE-2026-50656 and patched it the following month; a ShieldBreak bypass later received CVE-2026-69414. Three of the researcher’s earlier Defender flaws have been exploited in attacks, the source notes, but SignDrop is a different class of issue that targets the CLFS driver’s authentication feature rather than race conditions in Defender’s file handling. The vendor’s security update guide is the place to watch for a formal response.
What this means for administrators, defenders, and adversaries
- Administrators: Check exposure by reading HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication; a Mode value of 0 or 1 falls within the researcher’s claimed scope. The vendor’s mitigation guidance describes the setting and warns that setting the registry value to 2 or 3 disables the CLFS authentication protection and reopens older memory-corruption risks the protection was designed to prevent.
- Defenders and endpoint teams: Note that the published chain depends on an enabled antimalware process running elevated, and that the exploit’s noisy behavior — UAC prompts producing both standard-user and SYSTEM shells — makes active exploitation observable at the endpoint.
- Adversaries: The researcher’s public code demonstrates a path to SYSTEM that is specific to CLFS authentication logic and object manager symbolic-link redirection; however, independent testing so far reports reliability issues that limit operational utility.
SignDrop places a technical question in plain terms: a security feature meant to reduce kernel-layer risk can be redirected into privilege elevation if companion-file creation is performed in a privileged context that inherits user-controlled attributes. Microsoft’s security update guide is where organisations should look for a formal advisory or patch; in the meantime, checking CLFS Authentication Mode and understanding the trade-offs of disabling the protection are the immediate steps underlined by the published work and independent testing.
