SUSP_CLFS_Auth_File_Redirect_Exploit_Nov26

rule SUSP_CLFS_Auth_File_Redirect_Exploit_Nov26 {
   meta:
      description = "Detects executables that combine direct access to the CLFS device namespace, CLFS authentication file (.cnpf) references and object manager symbolic link creation, a combination used by exploits like SignDrop to redirect CLFS authentication file creation to an attacker-chosen path."
      author = "Florian Roth"
      date = "2026-11-13"
      reference = "https://github.com/MSNightmare/SignDrop"
      score = 65
      id = "c6e236f7-a823-530e-a96c-847c2bbd8aa8"
   strings:
      $clfs1 = "\\CLFS\\" ascii wide
      $clfs2 = "\\CLFS%" ascii wide

      $cnpf = ".cnpf" ascii wide

      $sym1 = "NtCreateSymbolicLinkObject" ascii

      $ns1 = "\\BaseNamedObjects\\Restricted" ascii wide
      $ns2 = "\\RPC Control\\" ascii wide
      $ns3 = "\\GlobalRoot\\" ascii wide nocase
   condition:
      uint16(0) == 0x5a4d
      and filesize < 20MB
      and 1 of ($clfs*)
      and $cnpf
      and $sym1
      and 1 of ($ns*)
}