New Windows SignDrop Zero-Day Gives SYSTEM Privileges

SignDrop is a new Windows zero-day that can let an attacker with local access gain SYSTEM privileges. Researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released the exploit, and Microsoft has no patch yet. BleepingComputer reported it on November 12, 2026.

You can check your exposure in a minute. The steps are below.

How SignDrop turns a Windows defense into an attack

In October 2025, Microsoft added mitigations to the Common Log File System (CLFS) driver. They defend against attacks that abuse CLFS vulnerabilities. Naceri says those attacks dropped sharply afterward. But he says the mitigation itself introduced this new flaw.

The problem is how CLFS creates an authentication file, .cnpf, when it creates a new log file. CLFS enforces access checks correctly at the start. The logic can be abused if a different, privileged process later opens the log file.

Naceri says privileged processes such as Windows Defender can be forced to open the files. The .cnpf file then gets created with SYSTEM privileges. CLFS gives it the original file's access permissions.

He is clear that Microsoft built the mitigation properly. In his words, "the logic allows abuse."

Which Windows versions are affected

Naceri tested the exploit on three builds. SignDrop does not work against every Windows machine. He estimates that 80% of Windows installations are vulnerable. That figure is his own estimate, not an independent measurement.

The registry value is the quickest safe check. If Mode is 0 or 1 (learning mode or enforcement mode), the computer is vulnerable.

How serious SignDrop is

The exploit is public, and SYSTEM is the highest local privilege level on Windows. An attacker who already runs code on a machine could use SignDrop to take it over completely.

The antivirus angle matters just as much. Naceri says the technique works against any antimalware engine's self-defense (tamper protection). The file-creation request appears to come from the engine's own legitimate process. To the engine's kernel drivers, it looks fine. He says this can be used to turn off any antivirus or EDR.

This is a local privilege escalation. The attacker needs a foothold first. That makes SignDrop a strong second-stage tool after phishing or a stolen low-privilege account. Microsoft has not confirmed a patch date, so watch the Microsoft Security Response Center for updates.

What to do now

There is no fix except waiting for a Microsoft patch. Naceri warns that disabling the CLFS mitigation would expose devices to attacks that exploit memory corruption vulnerabilities. Leave it on.

1. Check the CLFS authentication mode

Run this in an elevated Command Prompt:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication" /v Mode

Or use PowerShell:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CLFS\Authentication" -Name Mode

A value of 0 or 1 means the machine is vulnerable.

2. Confirm tamper protection is on

SignDrop targets self-defense, so verify what your endpoint protection reports. This command covers Microsoft Defender only:

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected

All three should be True. Alert on any machine where they flip to False. A sudden change can be an early sign of tampering.

If a machine runs a third-party antivirus or EDR, use that product's own console or status check instead. Naceri says SignDrop can turn off any antivirus or EDR, so monitor whichever product you run.

3. Hunt for the authentication file

This is a lead, not proof. It looks for .cnpf files, which the exploit abuses:

Get-ChildItem -Path C:\ -Recurse -Filter *.cnpf -Force -ErrorAction SilentlyContinue | Select-Object FullName, CreationTime, Length

Legitimate CLFS activity may also create these files. Look for ones in odd locations or created at unexpected times.

4. Be careful with the proof-of-concept

Naceri suggests running his PoC to test a device. If it spawns a SYSTEM shell, the machine is vulnerable. Only do this on an isolated test VM that mirrors your production build. Never run it on a production host.

A quick triage example

Say you manage 200 Windows 11 laptops and a few Windows Server 2025 hosts.

1. Push the registry query through your management tool and collect the Mode values.

2. Mark every device with 0 or 1 as exposed.

3. Rank exposed devices by who uses them. Admin workstations and servers come first.

4. Restrict local admin rights and remote logons on those devices. This shrinks the pool of people who could get a foothold.

5. Set an alert for tamper protection turning off, then re-run the check when Microsoft ships a patch.

What IT and security learners can take from this

SignDrop shows that a correct mitigation can still open a new path when its logic can be chained with other behavior. It also shows why defenders watch for tampering with security tools, not just for malware. Naceri has disclosed many other zero-days since April, and Microsoft has fixed some of them, including ShieldBreak, RoguePlanet, YellowKey, GreenPlasma and MiniPlasma. He disclosed these zero-days publicly without first reporting them privately to Microsoft, which is why defenders get no patch on day one. Privilege escalation, EDR evasion and patch triage come up constantly in real security work.

If you want a structured way to practice this thinking, the CompTIA SecurityX CAS-005 voucher covers advanced security operations and architecture. For the basics of how attackers move from foothold to full control, read our cyberattack stages guide.

Sources

• New Windows SignDrop zero-day gives hackers SYSTEM privileges (BleepingComputer)