9 min read
FalconFlank: privilege escalation through CrowdStrike Falcon's macro remediation
A published PoC turns Falcon's SYSTEM-level macro cleanup into an arbitrary write via a junction and an oplock race, dropping a DLL into System32. Root cause, mechanism and detection.