CVE-2026-50375: Windows dxgkrnl TOCTOU Privilege Escalation (ZDI-26-751) — Detection and Remediation Guide

---
title: Low-Integrity User Process Spawning SYSTEM-Integrity Child
description: Detects the hallmark of local privilege escalation exploitation (e.g., CVE-2026-50375 dxgkrnl TOCTOU) where a browser, Office application, or script host running in a user context spawns a child process at SYSTEM integrity. Legitimate software updaters are filtered to reduce noise.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-751/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  selection_integrity:
    IntegrityLevel: 'System'
  filter_updaters:
    Image|endswith:
      - '\GoogleUpdate.exe'
      - '\MicrosoftEdgeUpdate.exe'
      - '\setup.exe'
    CommandLine|contains:
      - 'MicrosoftEdgeUpdate'
      - 'GoogleUpdate'
  condition: selection_parent and selection_integrity and not filter_updaters
falsepositives:
  - Enterprise software deployment agents triggered from user sessions
  - Rare browser component installers (filtered above)
level: high
---
title: Non-Admin Junction or Symlink Creation Indicative of TOCTOU Redirection
description: Detects creation of NTFS junctions or symbolic links from command-line tooling, a technique frequently used to weaponize race-condition vulnerabilities by redirecting privileged file operations during the check/use window.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-751/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
      - 'mklink /J'
      - 'mklink /D'
      - 'mklink /H'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'New-Item'
      - 'SymbolicLink'
      - 'Junction'
  condition: selection_cmd or selection_ps
falsepositives:
  - Developer workflows and software packaging scripts
  - IT provisioning scripts that create profile redirection links
level: medium

// Hunt: integrity-level transition consistent with local privilege escalation (CVE-2026-50375 / dxgkrnl TOCTOU)
// Looks for SYSTEM-integrity processes whose initiating process was running at Low/Medium integrity from a user-context binary.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessIntegrityLevel in~ ("System", "High")
| where InitiatingProcessIntegrityLevel in~ ("Low", "Medium")
| where InitiatingProcessFileName in~ (
    "chrome.exe", "msedge.exe", "firefox.exe", "winword.exe", "excel.exe",
    "powerpnt.exe", "outlook.exe", "wscript.exe", "cscript.exe", "mshta.exe",
    "rundll32.exe", "powershell.exe", "cmd.exe")
| where FileName !in~ ("GoogleUpdate.exe", "MicrosoftEdgeUpdate.exe", "setup.exe", "msiexec.exe")
| summarize ProcessCount = count(),
            Commands = make_set(ProcessCommandLine, 5),
            Devices = make_set(DeviceName, 10)
    by InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, AccountName, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Secondary hunt: high-frequency graphics-stack interaction bursts from a single user process,
// a possible signature of race-condition trigger loops hammering dxgkrnl via GDI/DirectX calls.
// Tune the threshold to your baseline; start at 500 events/minute per process.
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType contains "Device" or InitiatingProcessCommandLine has_any ("gdi32", "d3d", "dxgi")
| summarize EventVolume = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessId, bin(TimeGenerated, 1m)
| where EventVolume > 500
| order by EventVolume desc;

-- Hunt for SYSTEM-level processes whose parent is a user-context application,
-- the post-exploitation fingerprint of a successful dxgkrnl LPE (CVE-2026-50375).
LET user_procs = SELECT Pid, Name, Exe, Username
FROM pslist()
WHERE Name =~ '(?i)(chrome|msedge|firefox|winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32|powershell|cmd)\.exe$'
  AND Username !~ '(?i)(SYSTEM|LOCAL SERVICE|NETWORK SERVICE)'

SELECT P.Pid AS SystemPid,
       P.Name AS SystemProcess,
       P.Exe AS SystemExe,
       P.Username AS SystemUser,
       P.CreateTime AS SpawnTime,
       U.Name AS ParentName,
       U.Username AS ParentUser,
       U.Exe AS ParentExe
FROM pslist() AS P
JOIN user_procs AS U ON P.Ppid = U.Pid
WHERE P.Username =~ '(?i)SYSTEM'
  AND P.Name !~ '(?i)(googleupdate|microsoftedgeupdate|setup|msiexec)\.exe$'

# CVE-2026-50375 (ZDI-26-751) — dxgkrnl TOCTOU LPE verification and remediation script
# Run elevated. Validates driver version, patch posture, and triggers an update scan.

# 1. Capture current dxgkrnl.sys version for comparison against the Microsoft advisory
$driverPath = "$env:SystemRoot\System32\drivers\dxgkrnl.sys"
if (Test-Path $driverPath) {
    $ver = (Get-Item $driverPath).VersionInfo
    Write-Host "[INFO] dxgkrnl.sys version: $($ver.FileVersion) | ProductVersion: $($ver.ProductVersion)"
} else {
    Write-Warning "dxgkrnl.sys not found at expected path — verify manually."
}

# 2. Report OS build to map against Microsoft's affected-products table
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "[INFO] OS: $($os.Caption) | Build: $($os.BuildNumber).$((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR)"

# 3. List security updates installed in the last 45 days — confirm the CVE-2026-50375 fix is present
Write-Host "[INFO] Recently installed hotfixes:"
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-45) } |
    Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize

# 4. Check for pending updates and force a Windows Update scan
$pending = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
try {
    $result = $pending.Search("IsInstalled=0 and Type='Software'")
    Write-Host "[INFO] Pending updates found: $($result.Updates.Count)"
    foreach ($u in $result.Updates) { Write-Host "  - $($u.Title)" }
} catch {
    Write-Warning "Update search failed: $_ — check WSUS/Intune compliance reporting instead."
}

# 5. Quick tripwire: enumerate suspicious junctions/symlinks in user-writable temp paths
Write-Host "[INFO] Scanning user temp directories for recently created reparse points..."
Get-ChildItem "$env:SystemDrive\Users" -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    Get-ChildItem "$($_.FullName)\AppData\Local\Temp" -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.Attributes -match 'ReparsePoint' -and $_.CreationTime -gt (Get-Date).AddDays(-7) } |
        Select-Object FullName, CreationTime
}

# 6. Confirm LSA protection and Credential Guard posture to limit post-LPE damage
$credGuard = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($credGuard) {
    Write-Host "[INFO] Credential Guard running: $($credGuard.SecurityServicesRunning -contains 1)"
}
$lsaRunAsPPL = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
Write-Host "[INFO] LSA RunAsPPL: $lsaRunAsPPL (1 = enabled)"