HardBreacher Zero-Day: Unpatched Kaspersky Endpoint Security Privilege Escalation PoC — Detection and Mitigation Guide

Security researcher Chaotic Eclipse — also publishing under the handles INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse — has publicly released HardBreacher, a proof-of-concept exploit for an unauthorized privilege gain vulnerability in Kaspersky Endpoint Security. No CVE identifier has been assigned, and critically, no vendor patch is available at the time of writing. This is a true zero-day in the classic sense: weaponizable PoC code in the wild ahead of any fix.

This researcher has a track record of releasing unpatched vulnerability PoCs — HardBreacher is described as another entry in a growing list targeting security software and the Windows platform. That pattern matters to defenders: security products themselves are high-value targets because a successful exploit against them yields elevated privileges on a system where defenders have already granted the product deep trust.

Why This Matters to Your Organization

Kaspersky Endpoint Security runs with SYSTEM-level privileges by design — that is the entire model of modern endpoint protection. Its core service process (typically avp.exe) must operate above other software to intercept and block malicious activity. Any local privilege escalation in that product chain converts a low-privileged foothold (a phished user, a compromised service account, initial access from commodity malware) into full SYSTEM control. Worse, attackers operating at the level of the security product itself are positioned to tamper with or disable the very telemetry your SOC depends on.

Organizations still running KES — whether due to regional requirements, legacy procurement, or multi-vendor defense-in-depth strategies — need to assume this PoC will be folded into commodity tooling quickly. Public PoC release is reliably the trigger for weaponization within days, not months.

Technical Analysis

What We Know

• Affected product: Kaspersky Endpoint Security (the corporate/enterprise line, distinct from consumer products)
• Vulnerability class: Unauthorized privilege gain — local privilege escalation (LPE)
• Exploit status: Public proof-of-concept released by the researcher; unpatched at disclosure
• CVE identifier: None assigned as of publication
• Attribution: Chaotic Eclipse / INFINITE NIGHTMARE / MSNightmare / Nightmare-Eclipse
• Source: Security Affairs coverage

Exploitation Model (Defender's View)

Privilege escalation flaws in endpoint security products generally follow one of several patterns, and defenders should instrument detection for all of them regardless of which specific mechanism HardBreacher uses:

1. Abuse of the privileged service interface. The AV service exposes IPC channels, device drivers, or management interfaces. Flaws in input validation or access control on these interfaces let a low-privileged process coerce the SYSTEM service into performing privileged operations on its behalf.

2. Self-protection bypass. EDR/AV products implement self-defense to prevent their files, registry keys, and processes from being modified. If that protection can be circumvented, an attacker can tamper with the product, plant components in its directories, or disable detection logic — all under the product's trusted context.

3. Privileged child process or component abuse. Legitimate-looking operations (scans, updates, quarantine restore, file operations performed by the service) can be leveraged to execute attacker-controlled code or overwrite arbitrary files with SYSTEM privileges.

The common observables: a non-system process interacting with Kaspersky binaries, directories, or registry keys, the AV service spawning unexpected child processes, and modification of Kaspersky configuration artifacts by accounts other than SYSTEM or the product's own service account. These are the behaviors your detection stack should be watching regardless of the exact exploitation primitive.

Exploitation Status

• PoC publicly released — treat as actively weaponizable
• Not currently listed in CISA KEV (no CVE assigned); monitor KEV daily
• No confirmed mass exploitation reported yet, but public PoC availability against a widely deployed security product historically precedes rapid adoption by both red teams and criminal operators

Detection & Response

The detections below focus on behavioral patterns around Kaspersky Endpoint Security components — interaction with the product's files, registry, and privileged processes by unexpected actors. These remain useful even after the exact vulnerability primitive is documented, because they target the exploitation outcome, not just one code path.

Sigma Rules

---
title: Suspicious Child Process Spawned by Kaspersky Endpoint Service
id: 8b2e4f17-3c5a-4d91-a6e2-9f1b7c3d5e8a
status: experimental
description: Detects command shells, script interpreters, or LOLBins spawned by the Kaspersky avp.exe service, which may indicate privilege escalation via a flaw such as HardBreacher in Kaspersky Endpoint Security.
references:
  - https://securityaffairs.com/198214/hacking/chaotic-eclipse-releases-kaspersky-zero-day-hardbreacher.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\avp.exe'
      - '\avpsus.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Kaspersky administrative scripts or deployment tooling invoked through the management console
level: high
---
title: Non-System Process Modifying Kaspersky Installation Directory
id: 3f7a9c24-6b1e-4d83-b2f5-8a4c6e9d1f3b
status: experimental
description: Detects file creation or modification inside Kaspersky Endpoint Security installation paths by processes running outside the product's own components, consistent with self-protection bypass or tampering via an LPE exploit such as HardBreacher.
references:
  - https://securityaffairs.com/198214/hacking/chaotic-eclipse-releases-kaspersky-zero-day-hardbreacher.html
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - ':\Program Files (x86)\Kaspersky Lab\'
      - ':\Program Files\Kaspersky Lab\'
      - ':\ProgramData\Kaspersky Lab\'
  filter_legit:
    Image|endswith:
      - '\avp.exe'
      - '\avpsus.exe'
      - '\klnagent.exe'
      - '\msiexec.exe'
    User|contains: 'SYSTEM'
  condition: selection_path and not filter_legit
falsepositives:
  - Software deployment tools performing KES upgrades (scope maintenance windows)
  - Kaspersky support gathering utilities
level: high
---
title: Kaspersky Self-Defense or Policy Registry Tampering
id: 5d1e8b36-9a4c-4f72-c3b6-2e7f9a1d4c6e
status: experimental
description: Detects modification of Kaspersky Endpoint Security registry configuration (self-defense, password protection, service settings) by processes other than Kaspersky components, a hallmark of AV tampering following privilege escalation.
references:
  - https://securityaffairs.com/198214/hacking/chaotic-eclipse-releases-kaspersky-zero-day-hardbreacher.html
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\SOFTWARE\KasperskyLab\'
      - '\SOFTWARE\WOW6432Node\KasperskyLab\'
      - '\SYSTEM\CurrentControlSet\Services\AVP\'
      - '\SYSTEM\CurrentControlSet\Services\klflt\'
      - '\SYSTEM\CurrentControlSet\Services\klick\'
  filter_legit:
    Image|endswith:
      - '\avp.exe'
      - '\msiexec.exe'
  condition: selection_key and not filter_legit
falsepositives:
  - Group Policy-based KES management
  - Scripted hardening baselines that touch Kaspersky policy keys
level: high

KQL Hunt (Microsoft Sentinel / Defender XDR)

This query hunts for the two highest-signal behaviors: the Kaspersky service spawning interactive tooling, and non-SYSTEM processes touching Kaspersky installation paths. Run it over at least 14 days to establish a baseline, then alert on new hits.

// Hunt: Privilege escalation and tampering against Kaspersky Endpoint Security (HardBreacher PoC)
// Part 1: avp.exe spawning interactive or scripting children
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","mshta.exe","regsvr32.exe","wmic.exe","net.exe","net1.exe","whoami.exe"]);
let ParentAbuse = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "avp.exe" or InitiatingProcessFileName =~ "avpsus.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId, InitiatingProcessId
| extend DetectionType = "KES service spawned suspicious child";
// Part 2: Non-system, non-Kaspersky processes writing to Kaspersky directories
let FileTamper = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has "Kaspersky Lab"
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| where InitiatingProcessFileName !in~ ("avp.exe","avpsus.exe","klnagent.exe","msiexec.exe","system")
| where InitiatingProcessAccountName !contains "system"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType
| extend DetectionType = "Non-system write to Kaspersky directory";
union ParentAbuse, FileTamper
| sort by TimeGenerated desc

Velociraptor VQL

Use this hunt to pull a live snapshot of any suspicious children of the Kaspersky service and unsigned or unexpected executables sitting in Kaspersky installation paths across the fleet.

-- HardBreacher hunt: suspicious Kaspersky service children and foreign binaries in KES paths
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)avp|avpsus'
   AND CommandLine =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32')
   OR Exe =~ '(?i)Program Files( \(x86\))?\\\\Kaspersky Lab\\\\.*\\.(exe|dll|sys)$'

-- Verify binaries in Kaspersky installation directories are authentic (Authenticode-signed)
SELECT FullPath, Size, Mtime,
       authenticode(filename=FullPath) AS Signature
FROM glob(globs=['C:/Program Files*/Kaspersky Lab/**/*.exe',
                 'C:/Program Files*/Kaspersky Lab/**/*.dll'])
WHERE NOT Signature.Trusted =~ 'trusted'

Verification and Hardening Script

The following PowerShell audits the Kaspersky installation state on a host: version inventory, service integrity, unsigned binaries in product directories, and recent non-system file modifications. Run it fleet-wide via your RMM or through Defender for Endpoint Live Response to establish exposure and detect tampering that may already have occurred.

# HardBreacher exposure and tamper audit for Kaspersky Endpoint Security
# Run as Administrator. Outputs a report object per host.

$report = [ordered]@{}
$report.Hostname = $env:COMPUTERNAME
$report.ScanTime = (Get-Date).ToString("o")

# 1. Identify installed Kaspersky products and versions
$kasperskyApps = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match "Kaspersky" } |
    Select-Object DisplayName, DisplayVersion, InstallDate
$report.KasperskyProducts = $kasperskyApps

# 2. Check the KES service state and binary path
$avpService = Get-Service -Name "AVP*" -ErrorAction SilentlyContinue
if ($avpService) {
    $svcPath = (Get-CimInstance Win32_Service -Filter "Name='$($avpService.Name)'").PathName
    $report.AvpService = @{ Name = $avpService.Name; State = $avpService.Status; Path = $svcPath }
} else {
    $report.AvpService = "Kaspersky Endpoint Security service not found - host may not be affected"
}

# 3. Flag unsigned or invalidly signed binaries inside Kaspersky directories
$kesDirs = @("$env:ProgramFiles\Kaspersky Lab", "${env:ProgramFiles(x86)}\Kaspersky Lab")
$unsigned = foreach ($dir in $kesDirs) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Recurse -Include *.exe,*.dll,*.sys -ErrorAction SilentlyContinue |
            ForEach-Object {
                $sig = Get-AuthenticodeSignature $_.FullName
                if ($sig.Status -ne "Valid") { $_.FullName }
            }
    }
}
$report.UnsignedBinariesInKesDirs = $unsigned

# 4. Recent (72h) non-system file modifications in Kaspersky directories - potential tampering
$cutoff = (Get-Date).AddHours(-72)
$recentWrites = foreach ($dir in $kesDirs) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-Object -First 50 FullName, LastWriteTime
    }
}
$report.RecentModifications = $recentWrites

# 5. Check for suspicious children of avp.exe in the last 24h via event log
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'avp\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|wscript\.exe|rundll32\.exe' } |
    Select-Object -First 20 TimeCreated, Message
$report.SuspiciousAvpChildren = $events

$report | ConvertTo-Json -Depth 5

Remediation and Mitigation

There is no patch. Your defensive posture has to be built on compensating controls until Kaspersky ships a fix.

Immediate actions (this week):

1. Confirm and harden Kaspersky Self-Defense. In KES policy settings, verify Self-Defense is enabled for both the service and the file system, and that Password Protection is set on all management operations (modify, disable, uninstall). A strong, vaulted administrative password raises the cost of post-exploitation tampering significantly. Note that a true self-defense bypass vulnerability may partially negate this — it is necessary but not sufficient.

2. Restrict local administrative access. This is a local privilege escalation — it requires code execution on the host first. Every standard user you strip of local admin rights, and every workstation where you enforce application control (WDAC/AppLocker), shrinks the pool of hosts where an attacker can stage the exploit in the first place.

3. Deploy the detections above. The Sigma rules, KQL hunt, and VQL artifacts target the exploitation outcomes — suspicious service children, directory tampering, registry modification — which remain observable regardless of the exact primitive the PoC uses.

4. Inventory your KES exposure. Know exactly which hosts run Kaspersky Endpoint Security, which versions, and which of those hosts are internet-facing, host sensitive data, or serve privileged users. Prioritize monitoring on that tier.

Near-term (days to weeks):

5. Monitor Kaspersky's official advisory channels daily. Track Kaspersky's support portal and product update feeds for the remediation release. Apply it within your emergency patch SLA — treat this with the same urgency as an exploited OS zero-day, because the PoC is already public.

6. Watch CISA KEV. Once a CVE is assigned and if exploitation is confirmed, expect rapid KEV inclusion, which carries its own remediation deadlines for federal agencies and serves as a forcing function for everyone else.

7. Layer detection independent of KES. Because this vulnerability undermines the endpoint agent itself, ensure you have telemetry that does not depend solely on the Kaspersky stack — Microsoft Defender for Endpoint (even in passive/EDR block mode alongside a third-party AV where licensed), Sysmon, and network-level detection. If KES is compromised, your SOC still sees the follow-on activity: credential access, lateral movement, C2.

8. Brief your IR team. Add a scenario to your runbooks: "KES tampering / AV self-defense bypass." Define escalation triggers (any hit on the Sigma rules above on a production server = immediate investigation) and evidence preservation steps, since AV product logs themselves may be untrustworthy in this scenario.

Strategic consideration: If your organization is in a jurisdiction or sector where Kaspersky usage is already restricted or discouraged, this unpatched LPE is another data point for the risk conversation with leadership. That is a governance decision, not a panic button — but it belongs on the CISO's agenda this quarter.

The Bottom Line

HardBreacher is public, unpatched, and targets a product that by definition holds the highest privileges on your endpoints. You cannot patch your way out today, so you detect, harden, and reduce the attack surface. The researchers releasing these PoCs are not slowing down — the defensive lesson is that your security stack is itself attack surface, and it needs the same behavioral monitoring, integrity verification, and independent telemetry as everything else it protects.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub