A working local privilege-escalation proof-of-concept against CrowdStrike Falcon went public with no CVE and no vendor advisory. We reproduced it in the lab, mapped exactly what it leaves behind in endpoint telemetry, and shipped real-time detections on the Vega platform to defend our customers. We are also sharing the exact detection logic so any team can deploy or hunt with it directly.
Why this matters
On September 3, 2026, a researcher going by Chaotic Eclipse published FalconFlank, a proof-of-concept that turns a low-privilege Windows user into SYSTEM by abusing a legitimate CrowdStrike Falcon feature: its cleanup of malicious Office macros. There is no CVE yet, and no vendor advisory. The exploit source is public, which means anyone can rebuild it and file off the obvious fingerprints.
That is a difficult starting point for any defender. A working local privilege-escalation PoC against an EDR a huge share of enterprises rely on, with no official guidance and a clock already running. Waiting for the vendor, a signature, or a writeup leaves a gap during the exact window when copies start circulating.
So we reproduced the exploit in a controlled lab, studied what it actually leaves behind in endpoint telemetry, and translated that into active detections on our platform. This post walks through the chain and shares each detection with the exact KQL it runs, so any team can deploy or hunt with it directy
What FalconFlank actually does
The exploit never needs write access to System32. It tricks the filesystem into redirecting a path the attacker controls onto one they don't, then lets a trusted SYSTEM task do the loading.
- 1.Stage a fake tree. Creates ...\Temp\Flanker_<random>\WindowsPowerShell\v1.0\ in the user's own Temp directory and drops a malicious bcrypt.dll inside.
- 2.Win a race. Places an oplock on that DLL. When anything touches the file, the exploit gets a sliver of time to act.
- 3.Swap in a junction. In that window it deletes the fake folder and replaces it with an NTFS junction pointing at the real PowerShell folder under System32.
- 4.Overwrite atomically. Using Transacted NTFS, it opens the real bcrypt.dll, overwrites it, and commits in a single transaction — so tools watching individual writes miss it.
- 5.Let SYSTEM run it. Falcon installs a scheduled task, MareBackup, that runs as SYSTEM. The exploit triggers it. The task loads the now-malicious bcrypt.dll and the attacker's code executes as SYSTEM.
- 6.Call home. A named pipe, FALCONFLANK, becomes the SYSTEM-level command channel.
Prerequisite: the exploit relies on the Microsoft Office file malicious macro removal feature being enabled in the Falcon prevention policy. That feature is the entry point.
The detail that shaped our detections
Key finding: In the lab, the final overwrite into the real System32 path never showed up in Falcon telemetry. Transacted NTFS commits the write as one atomic operation, and the per-file-write events simply are not there.
So the detections do not look for the step the exploit hides. They anchor on the three things it cannot hide:
An attacker can rename the pipe or the staging folder. They cannot avoid staging a DLL somewhere writable, cannot avoid the IPC channel, and cannot avoid triggering the SYSTEM task. That is where the detections anchor.
How Vega customers are protected
Vega ships five real-time detections for this activity, layered so that renaming the exploit's artifacts does not evade them:
- FalconFlank Exploit Privilege Escalation Indicators
- The exact fingerprints of the unmodified PoC: the FALCONFLANK pipe, Flanker_ staging folders, and the binary.
- System DLL Written to WindowsPowerShell Directory
- A DLL written into the PowerShell install directory, excluding the Modules subfolder and Windows servicing. Fires across CrowdStrike, Defender and SentinelOne telemetry.
- FalconFlank bcrypt DLL Staging with Named Pipe C2 on Same Host
- A non-system bcrypt.dll staged and a named pipe opened by a process running from Downloads or Temp on the same host.
- DLL Staged in System Path Under Temp with Named Pipe on Same Host
- A DLL staged under a Temp path that mimics a System32 subdirectory, plus a named pipe from Downloads or Temp on the same host.
- bcrypt DLL Replacement Followed by MareBackup Task Execution
- Each signal alone is common. A non-system bcrypt.dll write and the MareBackup task on the same host within an hour is the load stage.
Key takeaways
- Vega customers are protected with five real-time detections and pre-loaded threat-hunting queries for this activity.
- Speed beats waiting on a CVE. A public PoC can be reproduced and turned into shipped detections the same day, well before an advisory exists.
- Detect what the attacker cannot hide. The atomic Transacted-NTFS write is invisible; the staging, the named pipe, and the SYSTEM task are not.
- Layer brittle and resilient logic. IoC rules catch the unmodified PoC; correlated behavioral rules survive a rebuilt one.
Mitigation
If you run CrowdStrike Falcon, the control available today is to review whether Microsoft Office file malicious macro removal is enabled in your prevention policy, since that feature is the exploit's entry point. Pair that with the detections above to cover the behavior while the vendor position develops.