msnightmare/signdrop

How msnightmare/signdrop works

SignDrop is a Windows local-privilege-escalation proof of concept. Its principal workflow prepares a CLFS log/container and symbolic-link redirection, then invokes Windows Defender’s signature-update RPC so the privileged process opens the prepared container; the README describes the resulting SYSTEM-level impact. The implementation is concentrated in SigDrop.cpp, with windefend_h.h providing generated Defender RPC declarations. The excerpts show only parts of the PoC, so some detailed setup and completion steps are represented only where the README documents them.

Main entry points: SigDrop.cpp SignDrop PoC · windefend_h.h Defender RPC declarations · resource.h Embedded payload ID

Components 13

PoC workflow

SignDrop PoC SigDrop.cpp
CLFS setup SigDrop.cpp
Symbolic-link redirection SigDrop.cpp
Oplock coordination SigDrop.cpp
Defender RPC call SigDrop.cpp

Windows components

Defender RPC declarations windefend_h.h
Windows Defender
CLFS driver

Files and outcome

CLFS container files
Authentication file
Embedded payload ID resource.h
SYSTEM shell outcome

Other components

PoC operator

Connections 14

PoC operator → SignDrop PoC: runs README.md
SignDrop PoC → CLFS setup: prepares SigDrop.cpp
CLFS setup → CLFS driver: opens device README.md
CLFS setup → CLFS container files: creates SigDrop.cpp
Symbolic-link redirection → CLFS container files: redirects paths README.md
SignDrop PoC → Symbolic-link redirection: sets up SigDrop.cpp
SignDrop PoC → Oplock coordination: requests SigDrop.cpp
SignDrop PoC → Defender RPC call: starts worker SigDrop.cpp
Defender RPC call → Defender RPC declarations: uses procedure SigDrop.cpp
Defender RPC call → Windows Defender: calls update RPC SigDrop.cpp
Windows Defender → CLFS container files: opens as privileged process README.md
CLFS driver → Authentication file: creates signature README.md
SignDrop PoC → Embedded payload ID: looks up payload SigDrop.cpp
SignDrop PoC → SYSTEM shell outcome: achieves elevation README.md

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·