OFFSITE.DARK
← Signals

Sep 3, 2026

3 min

Project Nightcrawler

  • crowdstrike
  • falcon
  • zero-day
  • privilege-escalation
  • windows
  • lpe
  • edr
  • nightcrawler

news

FalconFlank: CrowdStrike Falcon Sensor Local Privilege Escalation

NightmareEclipse PoC abuses Falcon’s Microsoft Office malicious-macro remediation path for SYSTEM LPE on Win11 25H2 / Server 2025; CrowdStrike investigating, workaround is to disable that policy.

Summary

FalconFlank is a local privilege-escalation proof-of-concept published 2026-09-03 by NightmareEclipse / MSNightmare against CrowdStrike Falcon Sensor. The author states the chain abuses Falcon’s Microsoft Office file malicious macro removal remediation on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection, and that detections for the published sample should already exist — testers would need exclusions or a rewritten loader.

This is not remote code execution. It requires code already running as a local user, plus the Office-macro remediation policy enabled. CrowdStrike told press it is investigating; the interim control named in third-party coverage is to disable that Office malicious-macro remediation policy until a sensor fix ships.

OFFSITE.DARK indexes the Nightcrawler drop and vendor-status reporting. We did not discover or weaponize this flaw.

Key Findings

FindingDetail
ProductCrowdStrike Falcon Sensor (Windows)
ClassLocal privilege escalation (user → SYSTEM)
Trigger surfaceOffice malicious-macro file remediation
Claimed lab targetWin11 25H2 / Server 2025, Phase 3 Optimal Protection
Network RCENo
Published2026-09-03 on Project Nightcrawler
Vendor status (as of 2026-09-07 coverage)Investigation ongoing; workaround recommended
Author noteExpect Falcon detections on the unmodified PoC

What is claimed

Falcon’s Office-macro remediation is a privileged, automated response path: the sensor acts on a file the product has already classified as malicious. The published write-up treats that privileged handler as the integrity-crossing step. Details of the loader technique are omitted here; the defensive fact is that EDR self-remediation of Office documents is now a documented LPE surface on this cluster.

CrowdStrike detections for the stock binary do not close the class of bug. The author explicitly flags obfuscation / alternate DLL-load methods as the way a tester (or an adapter) would slip the sample.

Cluster context

FalconFlank is the CrowdStrike-facing member of the late-August / early-September NightmareEclipse AV/EDR expansion, alongside ShieldBreak / ShieldCrash (Defender), PrettyPrague (Avast), HardBreacher (Kaspersky), and GreenSection (NVIDIA).

Impact

  • Hosts that turned on Falcon’s Office macro-removal feature for defense-in-depth gain a new local SYSTEM path if the published class of bug is real and unpatched.
  • Enterprises that treat Falcon as the containment layer after a phishing macro still need a local-code-execution story; this PoC is that second stage, not the initial foothold.
  • Sample-specific Falcon detections are a speed bump, not a patch.

Mitigation

  1. Until CrowdStrike ships a sensor fix: disable Microsoft Office file malicious macro removal on Windows Falcon policies if operationally acceptable; keep other macro-blocking (ASR, Office cloud policy, Mark-of-the-Web) in place.
  2. Hunt for unexpected SYSTEM activity immediately after Falcon Office-file remediation events.
  3. Do not add the published PoC to exclusions outside isolated labs.
  4. Track CrowdStrike detection and sensor-build notes for FalconFlank / Office-macro remediation hardening.
  5. Treat Nightcrawler appearance as a watchlist item; block forge egress where policy requires.

Related Signals

Sources

→ Source