Tagged Privilege Escalation

FalconFlank: privilege escalation through CrowdStrike Falcon's macro remediation

A published PoC turns Falcon's SYSTEM-level macro cleanup into an arbitrary write via a junction and an oplock race, dropping a DLL into System32. Root cause, mechanism and detection.

• Vulnerability Analysis
• Privilege Escalation
• EDR
• CrowdStrike
• TOCTOU