GoKawiilResearcher discloses new Windows zero-day exploiting CLFS authentication mitigation
Security researcher Abdelhamid Naceri has published a zero-day called SignDrop that abuses a Microsoft mitigation introduced in October 2025 to protect against Common Log File System authentication attacks. Naceri says the flaw lies in how CLFS handles creation of its '.cnpf' authentication file, which can be forced open by a privileged process such as Windows Defender, allowing attackers to gain SYSTEM privileges. He also says the technique can bypass tamper-protection defenses in any antimalware engine because the file-creation request appears to originate from the engine's own trusted process.