FalconFlank: Privilege Escalation PoC Abusing CrowdStrike Falcon's Macro Removal Process

1. Basic Information

• Article Title: New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges
• Publisher: BleepingComputer
• Publication Date: 2026-09-04
• Original Source: BleepingComputer
• Related Sources: FalconFlank proof-of-concept repository, FalconFlank public code
• Related Malware, Attack Groups, CVEs, and Products: CrowdStrike Falcon Sensor, Windows 11 25H2, Windows Server 2025, Microsoft Office File Suspicious Macro Removal
• Severity: High
• Reason for Update: Content review on 2026-09-05: Clarified the boundary between the public PoC and active attacks, as well as determinations for acquisition, execution, and execution under SYSTEM privileges. Cross-referenced the DLL write actor and observation conditions with the public code, and refined the analysis and phrasing.

2. Executive Summary

Researchers have released a proof-of-concept (PoC) that exploits the Microsoft Office macro removal process in the Falcon Sensor to escalate privileges from a low-privileged local execution context to SYSTEM.

3. Attack Flow

Local Privilege Escalation via High-Privilege Macro Remediation

This privilege escalation flow is based on researcher explanations and public code. It is not an intrusion chain observed in active attacks.

1. It assumes the attacker has already achieved low-privileged code execution on the target Windows endpoint.
2. The PoC is executed in an environment where the Falcon Sensor's Office malicious macro removal feature is enabled.
3. The PoC leverages file operations related to macro remediation to target and write files in protected locations.
4. In the public code, the PoC itself writes DLL contents to C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll and triggers its loading.
5. Researchers explain that this ultimately leads to command execution with SYSTEM privileges.

4. Attacker Position and Execution Location

• An attacker who has already obtained low-privileged local code execution on the target Windows endpoint.

5. Visibility for Victims and Administrators

Victims

• Inference: If the process proceeds without additional user interaction, there may be no visible changes on the screen. An Office application interface may not necessarily appear.

Administrators

• Inference: If file operation and DLL loading logs are collected, writes to C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll and subsequent loading may be visible. If the writing process and execution privileges are also recorded, Falcon's remediation process can be distinguished from the actions of the PoC itself.

6. Success and Failure Conditions

Success Conditions

• The relevant macro removal setting in the CrowdStrike Falcon Sensor is enabled. The researcher's README states that it operates under a Phase 3 Optimal Protection configuration, but this does not confirm the scope of impact across all environments.
• The attacker can execute low-privileged code on the endpoint.
• Product detection or OS controls do not block the file operations and DLL loading utilized by the PoC.

Failure Conditions & Risk Mitigation

• Follow CrowdStrike's interim guidance to disable the Windows policy setting for Microsoft Office File Suspicious Macro Removal.
• Maintain Cloud Anti-malware for Microsoft Office Files and review Tech Alerts and updates on the support portal.
• Inference: Monitor EDR file operations, subsequent DLL loading, and execution with SYSTEM privileges. Monitoring alone may not prevent privilege escalation.

7. What Happens Upon Success

• The impact described by researchers upon success is privilege escalation from low-privileged local execution to NT AUTHORITY\SYSTEM.
• Inference: The mechanism appears to abuse EDR remediation processing to perform file operations in locations that are normally unwritable.
• Inference: If execution with SYSTEM privileges is achieved, subsequent operations such as defense evasion, credential theft, and persistence may become possible.

8. Observable Logs

• Email: Inference: If the initial compromise occurred via email, check delivery records for Office documents, compressed files, and links.
• Proxy/SWG/DNS: Inference: Check for the retrieval sources of the PoC and related files, access to public repositories, and post-privilege-escalation network traffic.
• Endpoint/EDR: Inference: Check for file operations related to macro remediation, writes to bcrypt.dll by the PoC process, and subsequent DLL loading and execution under SYSTEM privileges. Do not treat all writes as actions performed by Falcon itself.
• Identity/IdP: Inference: Check for credential usage after privilege escalation, device registration changes, and administrator sessions.
• SaaS/Cloud: Inference: Check Falcon policy changes, exclusion settings, sensor status, and management console operation history.
• Network: Inference: Check for communications to unknown destinations after endpoint compromise, internal reconnaissance, and connections to administrative shares or remote services.

9. Attack Success Determination

These criteria are for internal investigation and do not imply that success at each stage has been confirmed in the article.

• Attack Attempt Observed (Success Unconfirmed): Confirm records indicating an attempt by the PoC to abuse macro remediation processing. Treat PoC acquisition or repository browsing only as a trigger for investigation.
• User Interaction Confirmed: The premise of the public PoC is existing local execution by the attacker. There is no basis to require additional user interaction, and existing attacker code execution is not treated as user interaction.
• Initial Execution Confirmed: Confirm the execution of the PoC process. Macro remediation or high-privileged file operations alone do not confirm PoC execution or successful privilege escalation.
• Malware Execution or Authentication Success Confirmed: Confirm that attacker code was executed with SYSTEM privileges, correlated with PoC file operations and DLL loading. Suspicious SYSTEM processes or administrative credential usage alone do not confirm the success of this specific incident.
• Information Theft or Session Compromise Confirmed: Confirm unauthorized access or theft of credentials, browser data, or sensitive files. In the case of access logs only, separate the actor from the operation content.
• Subsequent Compromise Confirmed: Confirm persistence, security control modifications, lateral movement, or exfiltration.

10. Investigation Playbook

• Trigger: FalconFlank PoC execution artifacts, abnormal DLL immediately following macro remediation, high-privileged process creation.
• Initial Check: Check the Falcon Sensor version, applicable policies, Tech Alert application status, macro remediation timestamps, and endpoint users.
• Endpoint: Separate Falcon's remediation process from the PoC's own file operations, and investigate writes/reads to the target DLL, execution under SYSTEM privileges, and persistence.
• Authentication & Cloud: Check Falcon console policy/exclusion changes and administrator/SaaS authentication from the endpoint.
• Subsequent Operations: Track credential theft, defense evasion, internal reconnaissance, lateral movement, and exfiltration.
• Containment: Isolate suspicious endpoints and apply interim policies following the Tech Alert. Check the availability status and target versions of official fixes, and deploy them.
• Determination Categories: Distinguish between PoC acquisition, low-privileged execution, high-privileged file operations, SYSTEM execution, and subsequent compromise.

11. Defense and Detection Ideas

• Single Event: Inference: Use unexpected writes and DLL loading to the target path of the public PoC as a starting point for investigation. Separate remediation processing from the PoC write actor during review.
• Time-Series Correlation: Inference: Correlate PoC execution -> macro remediation-related file operations -> PoC DLL writes -> DLL loading -> execution with SYSTEM privileges. Review subsequent defense setting changes separately.
• Hunting: Search endpoints where the relevant policy is enabled for file operations related to remediation processing, writes to the PoC target path, and DLL loading.
• Log Gaps: If detailed EDR file operations are not visible, it is difficult to distinguish legitimate remediation from abuse.
• Priority Countermeasures: Prioritize interim policy changes, Tech Alert reviews, sensor updates, and monitoring for abnormal DLLs and SYSTEM execution.

12. Facts / Inference / Hypothesis

Facts

• Researchers released FalconFlank as a privilege escalation PoC that abuses the malicious Office macro removal process of the CrowdStrike Falcon Sensor.
• Researchers claim it operates on the latest environments of Windows 11 25H2 and Windows Server 2025.
• Researchers explain that success leads to command execution with SYSTEM privileges.
• In a spokesperson's response published by BleepingComputer, CrowdStrike stated it is investigating the claims and advised disabling the Windows policy setting for Microsoft Office File Suspicious Macro Removal.
• No CVE was assigned at the time of the original article's publication. Confirmed public information contains no descriptions confirming exploitation in active attacks.
• The public code implements logic where the PoC itself writes DLL contents to C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll.

Inference

• Based on researcher explanations and public code, the architecture appears to allow high-privilege security product remediation processes to be abused to cross privilege boundaries from low-privileged execution contexts.

Hypothesis

• The specific file placement and loading paths of the PoC may vary depending on the product version and OS configuration, and it may not function across all environments.

13. MITRE ATT&CK Mapping

• T1068 Exploitation for Privilege Escalation (High): Mapped to the privilege escalation abusing Falcon remediation demonstrated by the researcher's PoC.
• T1574.002 Hijack Execution Flow: DLL Side-Loading (Medium): Mapped to the DLL loading technique demonstrated in the researcher's public code. Detailed vendor verification is pending.

14. Unknowns / Additional Investigation

• Root cause confirmed by the vendor, affected Falcon Sensor versions, and patched versions.
• All conditions required for success and reliable artifacts of compromise.
• Examples of the PoC being used in actual attacks.
• Member-only Tech Alert details remain unconfirmed. Interim guidance is based on the CrowdStrike spokesperson's response published by BleepingComputer.

15. Impact on SOCs and Organizations

The lesson demonstrated by this PoC is that the high-privilege processes of security defenses must also be treated as privilege boundaries. The mere record of legitimate remediation processes running does not guarantee safety; it is necessary to track who modified files and under what privileges code executed before and after the event.

While CrowdStrike provides interim guidance to disable macro removal settings, it notes that protection via Cloud Anti-malware for Microsoft Office Files remains active. Organizations should distinguish between features being disabled and defenses that remain in place, and review the impact of configuration changes. Do not determine that an internal organization compromise has occurred based solely on the publication of a PoC.

16. Summary by Role

• For SOCs: Correlate operations related to macro remediation, PoC DLL writes, and execution with SYSTEM privileges; do not conclude a compromise occurred based solely on PoC acquisition.
• For Administrators: Adjust interim policies according to support portal Tech Alerts, and verify sensor updates and complementary defenses.
• For Users: Do not open suspicious Office documents and immediately report security warnings or anomalies on endpoints.