> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon - URL: https://f4n6.co.uk/security-feed/researcher-releases-falconflank-poc-showing-privilege-escalation-in-crowdstrike-falcon/ - Published: 2026-09-03T08:59:55.000Z - Updated: 2026-09-03T08:59:55.000Z - Author: Jeff Davies - Tags: #security-feed, Chaotic Eclipse --- ## 1\. Executive summary A security researcher operating as "Chaotic Eclipse" (aka INFINITE NIGHTMARE, MSNightmare, Nightmare-Eclipse) has publicly released a proof-of-concept exploit dubbed "FalconFlank," a zero-day local privilege escalation affecting the CrowdStrike Falcon sensor on Windows. The flaw abuses the Office malicious macros remediation component of the Falcon sensor, and the PoC is claimed to work on fully patched Windows 11 25H2 and Windows Server 2025 hosts running Falcon. No CVE has been assigned, no CVSS score exists in the verified reference data, and the flaw is not listed on CISA KEV — severity is therefore unassessed by NVD at time of writing. Attribution of the research to Chaotic Eclipse is single-sourced (The Hacker News reporting on a GitHub README) and the actor has no MITRE ATT&CK profile, so attribution is unconfirmed. The bottom-line risk for EMEA financial services: a public LPE against a widely deployed EDR agent is a force-multiplier for any adversary already holding user-level access on a Falcon-managed endpoint — it converts a foothold into SYSTEM while simultaneously undermining the integrity of the security control itself. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The existence of an unpatched flaw in a third-party security product does not, by itself, trigger incident classification, reporting, or testing obligations under the articles in scope; those obligations attach to actual incidents and to planned testing regimes, not to the publication of a PoC. Clients running Falcon should nonetheless treat this as input to their existing ICT third-party risk processes (DORA Art. 28: ICT third-party risk — general principles) in respect of CrowdStrike as a critical ICT third-party provider — but this is standing vendor-risk management, not a new obligation created by this item. ## 3\. Technical analysis & attack chain ### Confirmed from source material 1. **Vulnerability class:** Local privilege escalation (LPE), zero-day, in CrowdStrike Falcon sensor for Windows. 2. **Mechanism:** The flaw "abuses the office malicious macros remediation in CrowdStrike Falcon Sensor" — i.e., the sensor component that remediates malicious Office macros is the attack surface. The precise primitive (arbitrary file write, symlink abuse, DLL hijack of the remediation path) is **not specified** in the source material and we will not speculate. 3. **PoC availability:** Publicly released, with a GitHub README. The researcher states CrowdStrike "may already have detections for the flaw by now" and that testers "either have to add it to the exclusions or obfuscate the PoC and change the DLL load technique" — implying the PoC involves a DLL load and that Falcon's own detection logic can catch the unmodified exploit. 4. **Confirmed working environment:** Fully updated Windows 11 25H2 and Windows Server 2025, running CrowdStrike Falcon. 5. **No CVE, no CVSS, no CISA KEV entry** in the verified reference data. Do not treat third-party severity claims as authoritative. ### Context — same researcher's adjacent work (corroborated by the same single source) - **HardBreacher** — LPE PoC against Kaspersky Endpoint Security for Windows 14.0.0.504\. On success, drops `C:\Windows\System32\MY_SNAKE_IS_SOLID.dll` with full permissions for the current user; researcher describes taking control of the Kaspersky UI process, causing it to stop functioning or grant/block file access incorrectly. Researcher describes the PoC as unreliable ("duct taped", requires rerunning on error). - **ShieldBreak (CVE-2026-69414)** — Microsoft Defender zero-day granting NT AUTHORITY\\SYSTEM arbitrary code execution; assessed as a patch bypass of CVE-2026-50656 (RoguePlanet). LevelBlue describes the chain as combining Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path, redirecting Defender's clean engine to write an attacker-supplied DLL to `C:\Windows\System32\phoneinfo.dll`, followed by SYSTEM execution via the built-in Windows Error Reporting task. **Microsoft has yet to release a fix.** **Confidence caveat:** All technical detail above is single-sourced (The Hacker News, reporting the researcher's GitHub README and posts). The FalconFlank claim has not been independently corroborated by a second vendor or by CrowdStrike at time of writing; The Hacker News states it has contacted CrowdStrike for comment with no response yet. Verify before enforcement. ## 4\. Mitigation & containment No vendor fix is identified in the source material. Actions below are defensive posture measures pending CrowdStrike guidance. ### P1 — within 24 hours - Confirm Falcon sensor fleet currency: ensure all Windows endpoints/servers run the latest generally available sensor version. There is no patched version named in the source; currency is the only available lever until CrowdStrike publishes. - Hunt for the known artefacts of the researcher's adjacent PoCs on Falcon-managed estates (these are the only concrete file artefacts in the source material): `C:\Windows\System32\MY_SNAKE_IS_SOLID.dll` (HardBreacher/Kaspersky) and `C:\Windows\System32\phoneinfo.dll` (ShieldBreak/Defender). Presence of either on a host indicates active exploitation of this researcher's tooling. - Review Falcon exclusion lists for recently added entries — the researcher's own README implies testing requires adding exclusions, so an adversary replicating the technique may have attempted the same. ### P2 — within 72 hours - Contact CrowdStrike support/TA (or your MSSP's Falcon channel) for status on the FalconFlank report and any sensor-side detection or blocking already in place. The researcher's statement that CrowdStrike "may already have detections" is unverified. - Restrict local administrator-assisted tampering paths: enforce that standard users cannot modify sensor exclusions (Falcon API/console RBAC), and alert on any change to Falcon policy exclusions. - For Microsoft Defender estates in parallel: ShieldBreak (CVE-2026-69414) remains unpatched per the source; monitor `C:\Windows\System32\phoneinfo.dll` writes and Windows Error Reporting task execution on Defender-managed hosts. ### P3 — within 7 days - Fold this item into the next third-party risk review cycle with CrowdStrike (DORA Art. 28: ICT third-party risk — general principles), covering disclosure-response timelines for security-relevant flaws in the sensor itself. - Track for CVE assignment and CISA KEV listing; re-triage if either appears. ## 5\. Indicators of compromise No indicators of compromise are available for FalconFlank itself in the source material. The following atomic indicators relate to the same researcher's adjacent PoCs and are provided for hunting purposes only. | type | value | confidence | source | | -------- | ----------------------------------------------- | ---------------------------------------------------- | ------------------------------- | | filepath | C:\\Windows\\System32\\MY\_SNAKE\_IS\_SOLID.dll | Medium — researcher-stated, single-sourced | The Hacker News / GitHub README | | filepath | C:\\Windows\\System32\\phoneinfo.dll | Medium — vendor-analysed (LevelBlue), single-sourced | The Hacker News / LevelBlue | ```iocs filepath C:\Windows\System32\MY_SNAKE_IS_SOLID.dll filepath C:\Windows\System32\phoneinfo.dll ``` **Behavioural indicators** (FalconFlank and adjacent tooling — hunt, not block): | behaviour | where to observe | confidence | | --------------------------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------- | | New entries added to Falcon sensor exclusion lists | Falcon console audit log / API | Medium — implied by researcher README | | Unexpected DLL written to System32 by a security product's remediation path | EDR telemetry, Sysmon Event ID 11 | Medium — corroborated across HardBreacher and ShieldBreak descriptions | | Windows Error Reporting task executing from a System32 DLL write | Sysmon Event ID 1 (process creation), scheduled task logs | Medium — LevelBlue description of ShieldBreak chain | ## 6\. Detection ```yara rule FalconFlank_Family_System32_DLL_Drops { meta: author = "Adverse Trace" date = "2026-09-03" reference = "https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html" description = "Detects DLL artefacts associated with Chaotic Eclipse LPE PoC family (HardBreacher, ShieldBreak). FalconFlank itself has no published file artefacts." strings: $snake_dll = "MY_SNAKE_IS_SOLID.dll" wide ascii $phoneinfo = "phoneinfo.dll" wide ascii condition: 1 of them /* Note: these strings appear in the PoC's file-write paths; match against on-disk files in System32 or process command lines, not memory scans of arbitrary binaries. phoneinfo.dll is a legitimate Windows component name; treat matches as triage leads for unexpected System32 writes, not as confirmed detections. */ } ``` ```yaml title: Suspicious DLL write to System32 by security product remediation path id: 8c1f4a2e-9b3d-4e7f-a6c5-1d2e3f4a5b6c status: experimental description: > Detects writes of DLLs to System32 associated with the Chaotic Eclipse LPE PoC family (HardBreacher MY_SNAKE_IS_SOLID.dll; ShieldBreak phoneinfo.dll via Defender remediation + Windows Error Reporting task). FalconFlank involves a DLL load per the researcher README but no filename is published. references: - https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html author: Adverse Trace date: 2026/09/03 logsource: product: windows category: file_event detection: selection: TargetFilename: - 'C:\Windows\System32\MY_SNAKE_IS_SOLID.dll' - 'C:\Windows\System32\phoneinfo.dll' filter_legitimate_phoneinfo: TargetFilename: 'C:\Windows\System32\phoneinfo.dll' Image|endswith: '\TiWorker.exe' condition: selection and not 1 of filter_* falsepositives: - phoneinfo.dll is a legitimate Windows component; legitimate installs may write it level: high ``` ## 7\. Sources - The Hacker News — *Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon* — https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html — 2026-09-03 ## 8\. Adverse Trace position FalconFlank is an unpatched, publicly demonstrated local privilege escalation in CrowdStrike Falcon for Windows with no CVE, no CVSS score, and no CISA KEV listing in the verified reference data — we do not assign a severity where none exists, and we note the flaw is a local privilege escalation requiring an existing foothold, not a remote-access vector. The entire technical claim set is single-sourced to the researcher's GitHub README via The Hacker News, CrowdStrike has not yet responded publicly, and the actor has no MITRE ATT&CK profile, so both the flaw details and the attribution should be treated as unconfirmed pending vendor acknowledgement. Client impact is nonetheless real: EDR-agent LPEs degrade the integrity of the control that clients rely on for detection, and this researcher has demonstrated a consistent capability against security products (Kaspersky, Defender, now CrowdStrike) with at least one unpatched Microsoft flaw still outstanding. We will track CrowdStrike's response, CVE assignment, and any KEV listing, and will reissue this advisory at if a vendor fix or confirmed exploitation emerges. --- [Read the original source →](https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*