Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft · Windows
The flaw is an elevation of privilege vulnerability in the Common Log File System (CLFS) driver, a component of Microsoft Windows, caused by out-of-bounds write and heap-based buffer overflow weaknesses. An attacker with local access and low-privileged credentials, requiring no user interaction, could exploit it to gain elevated privileges on the affected system.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 8/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
- Run commands on the systemT1059 · Command and Scripting Interpreter
- Create a new account to keep accessT1136 · Create Account
- Dump stored passwords and hashesT1003 · OS Credential Dumping
- Move to other systems with remote loginsT1021 · Remote Services
- Encrypt files for ransomT1486 · Data Encrypted for Impact
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available the same day.
- DisclosedFirst seen exploitedVulnCheck KEV evidenceAdded to CISA KEVknown ransomware use; EU database agreesPublic exploit codeMetasploitday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
7 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 7Initial AccessTA0001
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
ExecutionTA0002
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges. This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs. Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
PersistenceTA0003
Privilege EscalationTA0004
Credential AccessTA0006
Lateral MovementTA0008
ImpactTA0040
Detection
0 rules for this CVE · 250 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-28252 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Create AccountT11363 general rules
OS Credential DumpingT100337 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Rubeus Executioncriticalstable
- Hacktool Execution - Imphashcriticaltest
- Potential Credential Dumping Via LSASS Process Clonecriticaltest
- WCE wceaux.dll Accesscriticaltest
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdumphightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Hacktool Execution - PE Metadatahightest
Remote ServicesT102111 general rules
- New RDP Connection Initiated From Domain Controllerhightest
- OpenCanary - FTP Login Attempthightest
- OpenCanary - SMB File Open Requesthightest
- OpenCanary - SNMP OID Requesthightest
- OpenCanary - SSH Login Attempthightest
- OpenCanary - SSH New Connection Attempthightest
- OpenCanary - VNC Connection Attempthightest
- Privilege Escalation via Named Pipe Impersonationhightest
Data Encrypted for ImpactT148617 general rules
- LockerGoga Ransomware Activitycriticalstable
- Antivirus - Ransomware Signaturecriticaltest
- Potential Conti Ransomware Activitycriticaltest
- WannaCry Ransomware Activitycriticaltest
- BlueSky Ransomware Artefactshightest
- Load Of RstrtMgr.DLL By A Suspicious Processhightest
- Renamed Gpg.EXE Executionhightest
- Suspicious Reg Add BitLockerhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX