{
  "schema_version": "1.0",
  "publisher": "AI Release",
  "article": {
    "title": "SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows",
    "canonical_url": "https://ai-release.org/posts/signdrop-v-drayvere-clfs-eksployt-otklyuchaet-lyuboy-antivirus-v-windo-930ed5e4_en.html",
    "language": "en",
    "article_type": "news",
    "published_at": "2026-11-14T00:00:00+00:00",
    "updated_at": "2026-11-14T00:00:00+00:00"
  },
  "summary": "Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM. By his estimate, 80% of Windows installs are affected; you can check via the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode or the PoC.",
  "topics": [
    "CLFS",
    "zero-day",
    "Windows",
    "cybersecurity",
    "AI",
    "эксплойт",
    "инфобез",
    "neural networks"
  ],
  "entities": [
    {
      "id": "E-SRC",
      "name": "habr.com",
      "type": "source",
      "description": "source domain",
      "url": "https://habr.com/ru/articles/1107890/"
    },
    {
      "id": "E-T1",
      "name": "CLFS",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T2",
      "name": "zero-day",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T3",
      "name": "Windows",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T4",
      "name": "cybersecurity",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T5",
      "name": "AI",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T6",
      "name": "эксплойт",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T7",
      "name": "инфобез",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T8",
      "name": "neural networks",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-AIR",
      "name": "AI Release",
      "type": "publisher",
      "description": "published the article",
      "url": "https://ai-release.org/"
    }
  ],
  "claims": [
    {
      "id": "AR-SIGNDROPVD-001",
      "statement": "Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-001",
      "evidence_excerpt": "Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM."
    },
    {
      "id": "AR-SIGNDROPVD-002",
      "statement": "By his estimate, 80% of Windows installs are affected; you can check via the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode or the PoC.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-002",
      "evidence_excerpt": "By his estimate, 80% of Windows installs are affected; you can check via the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode or the PoC."
    },
    {
      "id": "AR-SIGNDROPVD-003",
      "statement": "There's no patch and no workaround: disabling CLFS protection would simply open the door to the old memory-corruption attacks.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-003",
      "evidence_excerpt": "There's no patch and no workaround: disabling CLFS protection would simply open the door to the old memory-corruption attacks."
    },
    {
      "id": "AR-SIGNDROPVD-004",
      "statement": "Security engineer Abdelhamid Naceri, better known as Nightmare Eclipse or MSNightmare, has publicly released a zero-day exploit called SignDrop.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-004",
      "evidence_excerpt": "Security engineer Abdelhamid Naceri, better known as Nightmare Eclipse or MSNightmare, has publicly released a zero-day exploit called SignDrop."
    },
    {
      "id": "AR-SIGNDROPVD-005",
      "statement": "He found it in the Common Log File System (CLFS) driver — the very Windows component that has racked up more exploits than any other in recent years.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-005",
      "evidence_excerpt": "He found it in the Common Log File System (CLFS) driver — the very Windows component that has racked up more exploits than any other in recent years."
    },
    {
      "id": "AR-SIGNDROPVD-006",
      "statement": "Naceri himself is a former member of Microsoft 's V&M (Vulnerabilities & Mitigation) team at MSRC, so he knows this territory from the inside.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-006",
      "evidence_excerpt": "Naceri himself is a former member of Microsoft 's V&M (Vulnerabilities & Mitigation) team at MSRC, so he knows this territory from the inside."
    },
    {
      "id": "AR-SIGNDROPVD-007",
      "statement": "He posted the write-up and details publicly, and Habr summarized them in an article.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-007",
      "evidence_excerpt": "He posted the write-up and details publicly, and Habr summarized them in an article."
    },
    {
      "id": "AR-SIGNDROPVD-008",
      "statement": "Here's how it works.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107890/",
      "article_anchor": "#ai-claim-008",
      "evidence_excerpt": "Here's how it works."
    }
  ],
  "relationships": [
    {
      "subject": "habr.com",
      "predicate": "reports on",
      "object": "SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows",
      "claim_id": "AR-SIGNDROPVD-001"
    },
    {
      "subject": "AI Release",
      "predicate": "publishes",
      "object": "SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows",
      "claim_id": "AR-SIGNDROPVD-001"
    }
  ],
  "questions_and_answers": [
    {
      "question": "What is this article about?",
      "answer": "SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows. Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM.",
      "claim_ids": [
        "AR-SIGNDROPVD-001"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What happened?",
      "answer": "Nightmare Eclipse has published SignDrop — a zero-day in the CLFS driver of Windows that escalates privileges to SYSTEM. By his estimate, 80% of Windows installs are affected; you can check via the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CLFS\\Authentication\\Mode or the PoC. There's no patch and no workaround: disabling CLFS protection would simply open the door to the old memory-corruption attacks.",
      "claim_ids": [
        "AR-SIGNDROPVD-001",
        "AR-SIGNDROPVD-002",
        "AR-SIGNDROPVD-003"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "Who is the source?",
      "answer": "habr.com: https://habr.com/ru/articles/1107890/",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What remains unknown?",
      "answer": "The article reports the cited source; independent verification and full details are not provided.",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    }
  ],
  "limitations": [
    "No independent verification is provided.",
    "Full details, dates and official documents may be missing.",
    "The article reports a source rather than being the primary source."
  ],
  "citation": {
    "preferred_citation": "AI Release. «SignDrop in the CLFS driver: an exploit that disables any antivirus on Windows». 2026-11-14. https://ai-release.org/posts/signdrop-v-drayvere-clfs-eksployt-otklyuchaet-lyuboy-antivirus-v-windo-930ed5e4_en.html",
    "canonical_url": "https://ai-release.org/posts/signdrop-v-drayvere-clfs-eksployt-otklyuchaet-lyuboy-antivirus-v-windo-930ed5e4_en.html",
    "publisher": "AI Release"
  }
}