EXPL_SignDrop_CLFS_LPE_Nov26

rule EXPL_SignDrop_CLFS_LPE_Nov26 {
   meta:
      description = "Detects SignDrop (SigDrop.exe), a Windows local privilege escalation exploit by Nightmare-Eclipse (MSNightmare) that abuses the CLFS authentication mitigation. It coerces Microsoft Defender via the signature update RPC into creating a CLFS authentication file (.cnpf) as SYSTEM, redirected to C:\\Program Files\\Common Files\\microsoft shared\\ink\\hid.dll, and then gets that DLL loaded on the UAC secure desktop."
      author = "Florian Roth"
      date = "2026-11-13"
      reference = "https://github.com/MSNightmare/SignDrop"
      score = 80
      id = "2d03e489-db2c-5688-8f41-87b03f9ae4ca"
   strings:
      $x1 = "\\??\\%TEMP%\\SigDrop_" wide
      $x2 = "\\BaseNamedObjects\\Restricted\\mpasbase.vdm" wide
      $x3 = "\\CLFS%ws\\%ws" wide
      $x4 = "Failed to create CLFS containers, error : %d" ascii
      $x5 = "Failed to create clfs log file, error : 0x%0.8X" ascii

      $s1 = "%ws.cnpf" wide
      $s2 = "\\\\.\\GlobalRoot\\BaseNamedObjects\\Restricted\\" wide
      $s3 = "\\Common Files\\microsoft shared\\ink\\hid.dll" wide
      $s4 = "IMpService77BDAF73-B396-481F-9042-AD358843EC24" wide
      $s5 = "MpEngine.dll" wide fullword
      $s6 = "Failed to create bait file, error : 0x%0.8X" ascii
      $s7 = "This machine is not vulnerable." ascii
      $s8 = "\\Program Files\\Common Files\\microsoft shared\\ink" wide
   condition:
      uint16(0) == 0x5a4d
      and filesize < 10MB
      and (
         1 of ($x*)
         or 4 of ($s*)
      )
}