Chaotic Eclipse Releases CrowdStrike Falcon Zero-Day FalconFlank: Detection Guidance

Background

On September 3, 2026, a security researcher operating as Chaotic Eclipse, also tracked as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, published a proof-of-concept exploit named FalconFlank that targets the CrowdStrike Falcon endpoint platform. The exploit triggers a local privilege escalation flaw. It is the latest in a string of releases by the same researcher against endpoint and anti-malware products, following recent zero-days disclosed for Kaspersky Endpoint Security and Gen Digital Avast Antivirus.

The researcher has a history of dropping working exploits publicly, often after criticizing how vendors handle vulnerability reports. Past releases have mostly targeted Microsoft products including Windows and Microsoft Defender, and some were later abused in the wild. This post breaks down what FalconFlank does, the conditions required, and what defenders should do now.

Technical Details

FalconFlank, Local Privilege Escalation via Macro Remediation

According to the researcher, FalconFlank abuses Falcon's "Microsoft Office file malicious macro removal" feature. That function is part of Falcon's remediation capabilities and runs with high privileges. The core problem is a familiar one for endpoint detection and response products, which is that the elevated privileges the agent needs to protect a host also create an attack surface. An attacker with limited local access can attempt to abuse the security software itself to move from a low-privileged user to a more powerful context.

The published PoC reportedly works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon under Phase 3 Optimal Protection, with the malicious macro removal feature enabled. The technique relies on a DLL load, which the researcher notes can be altered to evade detection.

An important caveat comes from the researcher directly. The announcement warns that CrowdStrike may already have detections for the specific PoC as published, and suggests that testing it would require adding an exclusion or obfuscating the exploit and changing the DLL load technique. In practical terms this means the underlying weakness could persist even where Falcon detects and blocks the exact exploit shipped in the PoC. Detection of a known sample is not the same as remediation of the flaw it abuses.

At the time of writing, there is no assigned CVE, no confirmed vendor advisory, and no public confirmation from CrowdStrike regarding the validity or scope of the reported flaw. Treat the technical claims as researcher-provided and unverified until CrowdStrike responds.

Detecting FalconFlank

Because the technique rests on a privileged write into a protected directory followed by a privileged load, it is detectable in standard endpoint telemetry, including CrowdStrike Falcon Data Replicator (FDR) data and Windows Sysmon logging. Detection does not depend on CrowdStrike confirming the flaw, and it holds up against the researcher's own evasion advice, because it keys on the mechanism rather than on any specific payload, filename, or hash. ASTRO recommends the following behavioral detections, ordered from highest confidence to broadest hunt.

High-Confidence: The Abnormal OLE File Write

A unique behavior from the exploit is that it writes an OLE (Microsoft Office) file that ends in a DLL extension. The OLE content is needed by the exploit to trigger Falcon Office file macro remediation. It also places it in a staged path containing \WindowsPowerShell\v1.0\. We can implement the following detection pseudo logic for this.

In Abstract the rule to detect this is Windows - Suspicious OLE File Write

Pseudocode:

• Detects: an OleFileWritten action where a dll or exe are written, optionally to the \WindowsPowerShell\v1.0\

ALL:
 type            == "event"
 product         == "Falcon Data Replicator"
 action          == "OleFileWritten" # can extend to OoxmlFileWritten and RtfFileWritten

 ANY:
   file.path       ENDS WITH ".dll"
   file.path       ENDS WITH ".exe"  # can extend to .sys, .ocx, .cpl
   file.path       CONTAINS  "\WindowsPowerShell\v1.0\"


High-Confidence: The DLL Artifact

Another very reliable signal is the appearance of a bcrypt.dll in the PowerShell v1.0 application directory. On a clean system no bcrypt.dll lives there, because it always resolves from System32, so a bcrypt.dll written into that directory is an artifact of this particular FalconFlank chain. A hit is effectively free of false positives and should be handled as an incident rather than an attempt. This detection works against FDR file-write telemetry and Sysmon file-creation events, keying on the exact target path.

In Abstract the rule to detect this is: Windows - bcrypt.dll Loaded From PowerShell v1.0 Application Directory

Pseudocode:

• Detects: a file named bcrypt.dll being created directly in the PowerShell v1.0 application directory, which is an artifact of the FalconFlank DLL plant.

ALL:
 type            == "event"
 vendor          == "Microsoft"
 event.code      == "11"                    # Sysmon FileCreate
 action          == "FileCreate"
 file.path       ENDS_WITH "\WindowsPowerShell\v1.0\bcrypt.dll"

 ANY:
   event.dataset        == "Microsoft-Windows-Sysmon/Operational"
   log.origin.file.name == "Microsoft-Windows-Sysmon/Operational"


Broad Hunt: Any Loadable Module Planted for Search-Order Hijack

A wider version of the same idea watches for any loadable module written directly into the PowerShell v1.0 application directory, excluding the legitimate module subtree and localized resource assemblies. Where the bcrypt.dll alert catches the published chain exactly, this broader form catches variants that hijack a different library in the same directory. Note that the writing process may be attributed to a legitimate privileged security agent rather than to the attacker, so this hunt should not filter on the writing process. Review the writing process, the user context, and the host during triage rather than assuming a malicious writer.

In Abstract the rule to detect this is: Windows - DLL Written Into PowerShell v1.0 Application Directory

Pseudocode:

• Detects: any dll file being created directly in the PowerShell v1.0 application directory, which is a potential artifact of the FalconFlank DLL plant.

ALL:
 type            == "event"
 vendor          == "Microsoft"
 event.code      == "11"
 action          == "FileCreate"
 file.path       CONTAINS  "\WindowsPowerShell\v1.0\"
 file.path       ENDS_WITH ".dll"
 file.path       !CONTAINS  "\WindowsPowerShell\v1.0\Modules\"    # legit signed module DLLs
 file.path       !ENDS_WITH ".resources.dll"                      # .NET satellite assemblies

 ANY:
   event.dataset        == "Microsoft-Windows-Sysmon/Operational"
   log.origin.file.name == "Microsoft-Windows-Sysmon/Operational"


Resilient Detection: The Coordination Primitive

Another detection against an evolving exploit targets the setup and timing rather than the final file. Two patterns stand out. The first is a low-privileged process staging a mirror of the protected directory structure in a user-writable temporary location, which is the preparation step for redirecting a privileged write. The second is a low-privileged process establishing inter-process coordination, immediately followed on the same host and within a short window by a library landing in the protected system directory. That ordered pair is the observable silhouette of a timing-synchronized privileged-write race. Both survive payload obfuscation and component renaming, because they describe the mechanism the exploit cannot function without.

In Abstract the rule to detect this is:  Windows - System32 Directory Structure Mirrored Under User Temp Path

Pseudocode:

• Detects: a user temp directory being populated with a mirror of the System32 PowerShell v1.0 path, which is the staging step that happens before the plant succeeds.

ALL:
 type            == "event"
 vendor          == "Microsoft"
 event.code      == "11"
 action          == "FileCreate"
 file.path       CONTAINS  "\Temp\"
 file.path       CONTAINS  "\WindowsPowerShell\v1.0\"
 file.path       !CONTAINS  "\WindowsPowerShell\v1.0\Modules\"
 file.path       !ENDS_WITH ".resources.dll"

 ANY:
   event.dataset        == "Microsoft-Windows-Sysmon/Operational"
   log.origin.file.name == "Microsoft-Windows-Sysmon/Operational"


‍

Recommendations

Immediate Actions

• Monitor CrowdStrike's official channels for confirmation, affected sensor versions, and any content or configuration update, and apply vendor guidance as soon as it is published. Do not treat the presence of a detection for the public proof of concept as evidence that the underlying issue is remediated.
• Reduce the low-privileged foothold this technique requires. Enforce least privilege on endpoints, restrict local administrator rights, and apply application control so that an attacker has less room to stage and launch the chain in the first place.
• Review where privileged remediation features, including Office macro remediation, are enabled across the fleet so you can reason about exposure while vendor validation is pending.
• Never execute the public proof of concept on production systems. The exploit is distributed publicly and its author describes techniques for evading detection, so any testing belongs in an isolated lab.

Detection and Monitoring

• Deploy the behavioral detections above against your FDR or Sysmon telemetry. Prioritize the high-confidence artifact alert for real-time response and run the coordination-primitive logic as a resilient backstop against obfuscated variants.
• Watch for tampering with endpoint protection, including new or modified sensor exclusions, policy changes, and disruption of the agent's own processes or file-access controls, all of which are common precursors and side effects of EDR abuse.
• Centralize and correlate endpoint telemetry so that privileged writes, module loads, directory staging, and coordination events can be assembled into a single investigable sequence rather than surfacing as isolated, low-priority events.

References

• Security Affairs, "Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank," September 3, 2026
• CrowdStrike Support Portal and security advisories, for official status and any sensor updates

‍