CrowdStrike Falcon Zero-Day FalconFlank PoC Published: Local Privilege Escalation to SYSTEM; Vendor Advises Temporarily Disabling Malicious Macro Removal Policy
Researcher Nightmare Eclipse published a PoC for CrowdStrike Falcon zero-day LPE FalconFlank. It abuses the malicious-macro removal feature to obtain SYSTEM on fully patched Windows 11 25H2 and Windows Server 2025. CrowdStrike advises temporarily disabling the related policy.
On 3 September, researcher Nightmare Eclipse published FalconFlank on GitHub: a zero-day exploit against the CrowdStrike Falcon endpoint platform. A local low-privileged user can escalate to SYSTEM on fully patched Windows 11 25H2 and Windows Server 2025. No CVE or CVSS yet. CrowdStrike confirmed it is investigating and issued temporary mitigation guidance to 88,000+ customers.
Incident Overview
FalconFlank abuses the Falcon sensor's Microsoft Office malicious-macro removal feature. That feature runs as a SYSTEM service and auto-strips suspicious macros from Office documents. The researcher exploited a trust-boundary flaw in its privileged file operations, causing the security agent to execute attacker-controlled content at highest privilege. Security researcher Kevin Beaumont confirmed the exploit works on current Windows and Falcon agent builds. The same researcher this week also disclosed HardBreacher against Kaspersky Endpoint Security (fixed via database update) and PrettyPrague against Avast (dumps SAM and yields a SYSTEM shell; Gen Digital confirmed and is developing a patch)—a research series targeting endpoint-security fix pipelines.
Technical Details
Per the public PoC and SOCRadar analysis, the exploit chain combines four Windows primitives: named-pipe operations, NTFS reparse point redirection, DLL injection, and system API calls. Core idea: a low-priv attacker pre-stages malicious content so Falcon's SYSTEM-level cleanup routine hits an attacker-controlled path during privileged file ops—the agent's trust is borrowed as an LPE channel. Prerequisites: Windows 11 25H2 or Windows Server 2025, Falcon configured for Phase 3 optimal protection, and Office malicious-macro removal policy enabled. SOCRadar notes that even if CrowdStrike shipped behavioral detections for the public PoC, the underlying bug may remain; attackers only need to change the DLL-load method to bypass.
Impact Assessment
EDR products must run high-privilege; that also makes them ideal LPE targets. Falcon's install base is the largest victim surface in this research series so far. In a real chain, phishing or similar yields a low-priv foothold, then this bug disables protection, dumps credentials, and enables lateral movement. The bug lives inside the defensive software, so the trust-the-EDR assumption fails. No in-the-wild use by other actors reported yet, but the PoC is fully public; weaponization risk is sharply higher.
Remediation
- Per CrowdStrike guidance, temporarily disable the Microsoft Office File Suspicious Macro Removal policy. Cloud Anti-malware for Microsoft Office Files is unaffected; leave it enabled.
- Log into the CrowdStrike support portal, read the FalconFlank Tech Alert, follow environment-specific steps. Deploy the fixed sensor as soon as it ships.
- Detection: watch CSFalconService.exe and other security-agent processes spawning atypical cmd.exe/powershell.exe trees as SYSTEM, plus anomalous file ops tied to macro cleanup.
- Track the same research series against other EDR/AV (Kaspersky, Avast, etc.); verify those products' patch status.
- Shrink local attack surface: restrict low-priv users' access to sensitive directories and named pipes. Makes foothold-to-LPE conversion harder.
References
- Tech Times: FalconFlank zero-day and vendor response
- NetSecOps: FalconFlank zero-day exploit analysis
- DBAPPSecurity Threat Intelligence Center: CrowdStrike Falcon LPE PoC disclosure