> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# FalconFlank Zero-Day Hits CrowdStrike Falcon Sensor
- URL: https://f4n6.co.uk/security-feed/falconflank-zero-day-hits-crowdstrike-falcon-sensor/
- Published: 2026-09-05T23:58:01.000Z
- Updated: 2026-09-05T23:58:01.000Z
- Author: Jeff Davies
- Tags: #security-feed, Chaotic Eclipse

## 1\. Executive summary

On 3 September 2026, a security researcher operating as Chaotic Eclipse (aliases Nightmare-Eclipse, MSNightmare, INFINITE NIGHTMARE) published a working privilege-escalation proof-of-concept, "FalconFlank", to GitHub without prior notice to CrowdStrike. The PoC targets the Microsoft Office malicious macro remediation feature in CrowdStrike Falcon Sensor on fully patched Windows 11 25H2 and Windows Server 2025 hosts running Falcon with Phase 3 – Optimal Protection and the macro-removal policy enabled. No CVE ID has been assigned and no CVSS score exists in the verified reference data; there is no CISA KEV listing. CrowdStrike has acknowledged the claims and is advising customers to disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting while its investigation continues. EMEA financial services clients running Falcon with this feature enabled should treat local privilege escalation on endpoints as a live exposure: the exploit code is public, and the researcher states CrowdStrike detections can be bypassed via exclusions or by obfuscating the PoC and changing the DLL load technique.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The item is a public PoC for an unpatched, un-CVE'd flaw with no confirmed exploitation in the wild; no client incident, major-incident classification threshold, or third-party contractual trigger is evidenced in the source material. Clients should nonetheless track vendor guidance through their existing ICT incident-management and ICT third-party risk processes for Falcon as a critical supplier.

## 3\. Technical analysis & attack chain

### Confirmed facts (multi-source: The Hacker News, The Register, databreaches.net)

1. **Vulnerability class:** Local privilege escalation in CrowdStrike Falcon Sensor, abusing the Microsoft Office malicious macro remediation feature — the automated component that inspects Office documents and strips suspect macro code before execution.
2. **Affected configuration:** Fully updated Windows 11 25H2 and Windows Server 2025 running CrowdStrike Falcon with Phase 3 – Optimal Protection and the malicious macro removal feature enabled.
3. **Release posture:** Working PoC published to GitHub on 3 September 2026 with no advance notice to CrowdStrike. No CVE ID assigned. CrowdStrike states it is "actively investigating these claims".
4. **Vendor workaround:** CrowdStrike advises customers to disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting; the vendor asserts customers "remain protected through the Cloud Anti-malware for Microsoft Office Files settings" and points to a FalconFlank Tech Alert in the CrowdStrike support portal.
5. **Independent validation:** Kevin Beaumont confirmed the exploit works, along with several other PoCs the researcher released in the same period.

**Mechanism detail:** The specific privilege-escalation path (e.g. the exact service or process context in which the macro-remediation component runs, or the precise DLL load technique) is not described in the available source material beyond the researcher's note that the PoC can be adapted by "obfuscat\[ing\] the PoC and chang\[ing\] the dll load technique" — which indicates a DLL-loading abuse path but does not specify the component, file path, or registry key involved. Do not assume specifics beyond this.

**Detection-evasion caveat:** The researcher states CrowdStrike would already have detections for the published PoC and that testing requires either adding it to exclusions or obfuscating it and changing the DLL load technique. Treat the public PoC hash as low-value for detection; assume modified variants will not match naive signatures.

**Attribution caveat:** "Chaotic Eclipse" has no MITRE ATT&CK profile in the verified reference data — attribution is unconfirmed and, in any case, this is a researcher disclosure, not a threat-actor campaign. The Register characterises the researcher as "disgruntled" and previously focused on Microsoft zero-days; this is single-sourced colour, not a technical fact.

**Context (same researcher, same week — corroborated by The Register, validated by Beaumont):** HardBreacher (EoP in Kaspersky Endpoint, confirmed working on fully patched Windows 11 25H2 with Kaspersky for Endpoint v14.0.0.504), PrettyPrague (EoP in Gen Digital Avast — "dumps the SAM database by abusing a vulnerability in Avast Sandbox and spawns a full SYSTEM shell"; Gen Digital confirms and is patching), and GreenSection (Nvidia memory corruption; per Beaumont, crash-only). These are separate products; only act on them if those vendors are in your estate.

## 4\. Mitigation & containment

### P1 — within 24 hours

- Identify all Falcon-managed Windows 11 25H2 and Windows Server 2025 hosts with the "Microsoft Office File Suspicious Macro Removal" Windows policy setting enabled. CrowdStrike's stated workaround is to **disable that policy setting**; verify the FalconFlank Tech Alert in the CrowdStrike support portal for the current vendor position before rolling out, as guidance may have moved since 3 September.
- Confirm the compensating control is in place per CrowdStrike: Cloud Anti-malware for Microsoft Office Files remains enabled.
- Do not add the public PoC to Falcon exclusions for testing on production endpoints; the researcher's own README notes exclusions are the trivial bypass path. Any validation must occur in an isolated, non-production lab.

### P2 — within 72 hours

- Review Falcon policy baselines across the estate: document which sensor policy profiles enable macro remediation, and record the Phase 3 – Optimal Protection coverage so exposure can be re-scoped when CrowdStrike publishes its findings or a patch.
- Hunt for anomalous local privilege elevation on Falcon endpoints since 3 September 2026: unexpected SYSTEM shells, suspicious DLL loads into Falcon-related processes, and any tampering with Office macro-remediation components. Note the source material gives no specific artefacts for this hunt — scope it as generic EoP monitoring until CrowdStrike publishes technical detail.
- If Kaspersky Endpoint (v14.0.0.504), Avast, or Nvidia drivers are present anywhere in the estate, triage the sibling PoCs (HardBreacher, PrettyPrague, GreenSection) against those assets.

### P3 — within 7 days

- Track the CrowdStrike support portal for a sensor update or hardened configuration; apply it when released and re-enable macro remediation only on the vendor's instruction.
- Feed this item into the ICT third-party risk process for CrowdStrike as a critical security supplier: request the vendor's root-cause and remediation timeline through your account channel.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The public GitHub repository contains PoC code, but no file hashes, domains, IPs, or other atomic indicators are given in the sources, and the researcher explicitly states the published PoC will already be detected and is intended to be modified. We will not reproduce repository links as IOCs; the PoC is offensive tooling, not observed intrusion artefacts.

### Behavioural indicators

| Behaviour                                                                                                           | Where to observe                                                                                            | Confidence                                                                           |
| ------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Privilege escalation to SYSTEM on hosts with Falcon macro remediation enabled, via DLL load technique abuse         | EDR telemetry: suspicious DLL loads, child processes running as SYSTEM from Falcon macro-inspection context | Medium — mechanism implied by researcher README; exact process context not published |
| Modified/obfuscated variants of the public PoC (researcher states detection evasion via changed DLL load technique) | EDR behavioural detection on anomalous DLL load paths, not hash matching                                    | Medium — single-sourced (researcher README)                                          |

## 6\. Detection

Insufficient indicators to author detection rules. The sources contain no file hashes, distinctive strings, mutexes, file paths, registry keys, or command-line artefacts from the exploit itself. A rule keyed on "FalconFlank", the researcher's aliases, or CrowdStrike product strings would detect reporting about the threat, not the threat. Revisit when CrowdStrike's Tech Alert or the researcher's full technical write-up publishes concrete artefacts.

## 7\. Sources

- databreaches.net — "FalconFlank Zero-Day Hits CrowdStrike Falcon Sensor" — https://databreaches.net/2026/09/05/falconflank-zero-day-hits-crowdstrike-falcon-sensor/ — 2026-09-05
- The Hacker News — "Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon" — https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html — September 2026
- The Register Security — "Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC" — https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318 — 2026-09-03

## 8\. Adverse Trace position

No CVE, no CVSS score, and no CISA KEV entry exist for this flaw in the verified reference data, and we will not invent a severity rating: the honest assessment is **exposure is real but unquantified** — a publicly released, independently verified (Beaumont, single named validator) privilege-escalation PoC against a security agent that runs at high privilege on financial-services endpoints, with no vendor patch yet and a researcher who has published three other working EoP PoCs in the same week. Attribution to "Chaotic Eclipse" is unconfirmed (no MITRE ATT&CK profile); this is a researcher disclosure, not an observed campaign, and there is no evidence of in-the-wild exploitation. Client impact concentrates on Falcon-managed Windows 11 25H2 / Server 2025 estates with macro remediation enabled; the CrowdStrike-recommended policy disable is a low-cost, reversible containment that we recommend taking now rather than waiting for a CVSS. We will monitor the CrowdStrike support portal Tech Alert, any CVE assignment, and CISA KEV, and will reissue this advisory with detection content and a scored position when the vendor publishes technical detail.

---

[Read the original source →](https://databreaches.net/2026/09/05/falconflank-zero-day-hits-crowdstrike-falcon-sensor/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*