CVE-2026-68820 — Windows AFD.sys Use-After-Free Local Privilege Escalation

CVE-2026-68820 is a use-after-free (CWE-416) elevation-of-privilege vulnerability in afd.sys, the Windows Ancillary Function Driver for WinSock — a kernel-mode component present on every supported Windows 10, Windows 11, and Windows Server build. The flaw comes from improper synchronization when multiple threads interact with socket-related kernel state concurrently: one code path can free a kernel object while another thread still references it. An attacker who already has arbitrary local code execution can repeatedly trigger the race, land in the vulnerable timing window, and turn the resulting memory corruption into an arbitrary kernel read/write primitive — which they use to escalate their own token to SYSTEM. No further user interaction is required. Microsoft patched it in the August 2026 Patch Tuesday cumulative update; CISA added it to the KEV catalog the same day (2026-08-11) citing confirmed active exploitation, with reporting from Check Point Research and others linking exploitation to the North Korea-linked Lazarus group's Operation Dream Job campaign against defense-sector targets.

Attacker objective: convert an existing low-privilege foothold — however it was obtained — into unrestricted SYSTEM control, then use that control to blind or disable security tooling, dump credentials (commonly LSASS), move laterally, or stage ransomware. Highest-value defensive angle: this is inherently a second-stage exploit. It cannot fire without a foothold that already exists, so the exploit itself is largely invisible to standard EDR telemetry (the kernel race and memory corruption happen inside the driver, not as a queryable Falcon event) — but its effects are not: a discontinuous jump to SYSTEM from a process lineage that has no business producing SYSTEM children, followed within minutes by security-tool tampering or new persistence, is the pattern this pack hunts for. Patch and reboot close the vulnerability; the queries below catch the attacker who already exploited it before your fleet finished rebooting, or who is exploiting an unpatched or un-rebooted host right now.

Defender priority: patch alone does not remediate a running system — afd.sys stays loaded and vulnerable in memory until the endpoint reboots. Confirm both patch installation and post-patch reboot before considering a host remediated (see §13 playbook and the audit block in §10).

16 sources were fetched and saved as plain-text snapshots to CVE-2026-68820-WindowsAFD-Hunt-sources/ for provenance. 11 yielded usable content; 3 were inaccessible (HTTP 403) and are excluded from every claim below; 1 (MSRC's own advisory portal) is JavaScript-rendered and returned only a page shell, but its substantive content was independently corroborated by three sources that quote or mirror it directly. No fetched source contained any text addressed to an AI or attempting to direct this agent's actions — see the note at the foot of this section.

No injected instructions found: every fetched source was reviewed for text addressed to an AI (prompt-injection attempts). None was present in any of the 11 successfully-fetched sources. This is noted per this pack's build instructions, not because anything was found.

Hunt hypotheses (ordered by fidelity)

1. H1 (high conf): A process authenticates or executes as SYSTEM whose parent is not one of the small set of OS components that legitimately spawn SYSTEM children — the direct fingerprint of a successful local-to-SYSTEM elevation. → Q1
2. H2 (high conf): Within the same SYSTEM context, a security-tooling tamper command executes (stop/disable AV/EDR service, registry disable flags) — the near-universal next step after this exploit succeeds. → Q2, Q5
3. H3 (medium conf): A SYSTEM-context actor outside normal installers creates autostart persistence shortly after an anomalous elevation — establishing durability post-exploitation. → Q3
4. H4 (medium conf): An executable is written to disk and, on the same host, a non-standard SYSTEM elevation follows — approximates "stage the exploit tool, then run it." → Q4
5. H5 (low conf, pivot-only): A single non-privileged parent spawns processes in an abnormal burst — a very weak proxy for the repeated race-condition triggering this exploit class requires. → Q6

Attack chain

This is a kernel-level local-privilege-escalation exploit, not a campaign with C2 domains or a public malware sample corpus — no atomic indicators (hashes, IPs, domains) for the exploit itself were published in any source this pack could fetch. That is expected and normal; the table below is intentionally behavioral-first. See §10 for the copy-paste appendix.

Telemetry gap: direct AFD.sys kernel exception/crash telemetry (the exploit trigger itself) is not exposed via the standard Falcon EDR CQL field model — Falcon does not publish a queryable kernel-bugcheck or driver-fault event type in the documented data model. This pack can only detect the exploit's downstream effects (SYSTEM elevation, tool tampering, persistence), not the race condition in progress. Native OS crash-dump/WER review (§7) is the compensating control. This gap is carried into §15 Coverage Map.

Non-CQL checks that compensate for the telemetry gap noted in §5 — run these against Windows Event Log / Sysmon directly, on the host or via your log-forwarding pipeline.

• System log Event ID 1001 (BugCheck / WER): review for crash reports whose faulting module is afd.sys on unpatched or un-rebooted hosts — a crash here can indicate a failed or partially-successful exploitation attempt.
• Security log Event ID 4672 (Special privileges assigned to new logon): correlate the account name against your expected list of service/admin accounts — an unexpected standard-user account receiving this event is a strong elevation signal.
• Security log Event ID 4688 with command-line auditing enabled, filtered to TokenElevationType = TokenElevationTypeFull for processes whose parent is not a standard elevation broker (consent.exe, etc.).
• Sysmon Event ID 1 (Process Create): filter for IntegrityLevel = System where the parent process's own IntegrityLevel was Medium or lower — the classic host-based LPE fingerprint, and a useful cross-check against Q1 if Sysmon is deployed alongside Falcon.
• Driver/patch state audit: confirm both patch installation and the mandatory post-patch reboot (afd.sys is not swapped out of memory until reboot) — see the PowerShell audit block in §10.

Three queries are high-confidence enough to warrant promotion beyond hunt-only. Stage every one in Detect mode for at least 2 weeks against production traffic before considering Prevent.

No atomic indicators (hashes, C2 domains/IPs) for this exploit were published in any fetched source. The CSV below intentionally ships mostly REPLACE_WITH_ placeholders — populate them only if your own incident response surfaces a confirmed indicator. Shipping a fabricated hash or domain here would be worse than shipping none.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_SHA256,detect,high,2027-02-24,Unverified CVE-2026-68820 exploit binary or post-exploitation tool -- populate only if your own IR/EDR surfaces a hash,cve:CVE-2026-68820
domain,REPLACE_WITH_C2,detect,medium,2026-11-24,Unverified Operation Dream Job C2 infrastructure referenced in third-party reporting but not published with an indicator in any fetched source,actor:Lazarus
filename,afd.sys,enrich,low,2027-02-24,Legitimate Windows kernel driver targeted by CVE-2026-68820 -- context only, do NOT block/quarantine,cve:CVE-2026-68820

1. Process runs as SYSTEM; ParentBaseFileName is not a standard OS SYSTEM-spawning component (Q1)
2. SYSTEM-context command stops/disables AV, EDR, or Windows Security service (Q2)
3. SYSTEM-context registry write sets a security-product Disable* value (Q5)
4. New autostart entry created by a SYSTEM actor that is not a known installer (Q3)
5. Executable write followed by non-standard SYSTEM elevation on the same host (Q4)
6. Abnormal burst of process creation from one non-privileged parent (Q6, pivot-only)
7. System log Event ID 1001 (BugCheck/WER) naming afd.sys as the faulting module
8. Security log Event ID 4672 granted to an account outside the expected service/admin list

# Named by SOC Prime reporting on Lazarus / Operation Dream Job tradecraft.
# No file hash, filename, or path was published for either in any source
# this pack could fetch -- listed for analyst awareness and pivot only.
FudModule        kernel-mode rootkit (privilege-escalation payload class)
MISTPEN          in-memory downloader

# Confirm the August 2026 cumulative update is installed
Get-HotFix -Id KB5121003 -ErrorAction SilentlyContinue   # Windows 11
Get-HotFix -Id KB5120249 -ErrorAction SilentlyContinue   # Windows 10 ESU

# afd.sys is only replaced in memory after a reboot -- confirm uptime since patch
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

# Secondary signal: on-disk driver file version/date
Get-Item "$env:SystemRoot\System32\drivers\afd.sys" |
  Select-Object VersionInfo, LastWriteTime

• Telemetry ready: confirm ProcessRollup2/SyntheticProcessRollup2, AsepValueUpdate, and RegGenericValueUpdate are flowing for the target host population before enabling any query above as an alert.
• Benign baseline: run Q1 and Q3 in hunt-only (Investigate) mode for a minimum of 7 days per environment to build the ParentBaseFileName/ContextBaseFileName exclusion list before promoting either.
• Positive test: Q1 — in an isolated test VM, launch a process as SYSTEM via a non-standard parent (e.g. PsExec64.exe -s cmd.exe from an interactive session) and confirm the query surfaces it. Q2/Q5 — in the same test VM, run an excluded-from-production sc stop or registry-disable command against a disposable AV/EDR test instance and confirm detection fires. A real kernel exploitation of this CVE should never be simulated outside an isolated, disposable lab, and only against a still-vulnerable (unpatched) test image.
• Promotion: Q2 and Q5 are eligible for Prevent-mode Custom IOA after a clean 1-week Detect baseline (§9). Q1 and Q3 stay in Detect indefinitely given their FP profile. Q4 and Q6 remain hunt/investigate-only and should never be promoted to an alert as written.

Playbook 1 — Patch verification & enforced reboot

Prerequisites: WSUS/Intune/SCCM (or your patch-management tool) already targeting the August 2026 cumulative update at the affected build population. Reboot required: yes — this is the entire point of the playbook. Rollback: uninstalling a security cumulative update to roll back is not recommended; if the update causes a regression, engage Microsoft support rather than removing the patch, since removal reintroduces an actively-exploited kernel LPE.

# Step 1 -- confirm patch presence (see Copy CSV audit block in Section 10 for the full check)
Get-HotFix -Id KB5121003,KB5120249 -ErrorAction SilentlyContinue

# Step 2 -- if patched but LastBootUpTime predates the patch install date, force a
# scheduled reboot during the next maintenance window (adjust the delay to your change window)
if ((Get-CimInstance Win32_OperatingSystem).LastBootUpTime -lt (Get-Date).AddDays(-1)) {
    shutdown.exe /r /t 3600 /c "Mandatory reboot: CVE-2026-68820 (afd.sys) patch requires restart to take effect"
}

Playbook 2 — LSA Protection (RunAsPPL)

Prerequisites: pilot on a ring first; confirm no legacy LSASS-hooking security or SSO software is in use on target hosts. Reboot required: yes. Rollback: delete the RunAsPPL value (or set to 0) and reboot again.

# Deploy
$path = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
New-ItemProperty -Path $path -Name 'RunAsPPL' -Value 2 -PropertyType DWORD -Force | Out-Null
# Reboot required

# Verify (post-reboot)
(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL).RunAsPPL
# Expect: 2 -- and Event ID 12 ("LSASS was started as a protected process") in the System log

# Rollback
Remove-ItemProperty -Path $path -Name 'RunAsPPL' -ErrorAction SilentlyContinue
# Reboot required

Playbook 3 — ASR rule: block credential stealing from LSASS

Prerequisites: Defender Antivirus active (can coexist with Falcon in passive/EDR mode per your deployment); deploy in AuditMode across a pilot ring before Block. Reboot required: no. Rollback: re-run the same cmdlet with -AttackSurfaceReductionRules_Actions Disabled.

# Audit first
Set-MpPreference -AttackSurfaceReductionRules_Ids '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2' `
                 -AttackSurfaceReductionRules_Actions AuditMode
# Review Defender Event ID 1122 for hits over 1-2 weeks, then:
Set-MpPreference -AttackSurfaceReductionRules_Ids '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2' `
                 -AttackSurfaceReductionRules_Actions Enabled

# Rollback
Set-MpPreference -AttackSurfaceReductionRules_Ids '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2' `
                 -AttackSurfaceReductionRules_Actions Disabled

The primary gap is structural, not an oversight: the AFD.sys race condition itself has no queryable Falcon EDR event (§5), so this pack's coverage necessarily starts one step downstream, at the elevation and its aftermath. LSASS credential access after elevation has no dedicated CQL query in this pack — it is addressed via hardening (LSA Protection, ASR LSASS rule, §12) rather than detection, since a successful SYSTEM-level LSASS read is difficult to distinguish from legitimate SYSTEM-context tooling without additional context this exploit class doesn't provide. Validation gates for the queries that do exist are in §11.