MiniPlasma Zero-Day (cldflt.sys): Detection and Mitigation for Windows LPE

---
title: MiniPlasma - Suspicious Modification of Cloud Filter Driver Service
id: a9b2c3d4-5e6f-7890-1234-56789abcdef0
status: experimental
description: Detects modifications to the registry keys associated with the cldflt.sys driver (Cloud Files Filter). Attackers may alter service configuration to facilitate exploitation or persistence.
references:
  - https://thehackernews.com/2026/05/miniplasma-windows-0-day-enables-system.html
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.privilege_escalation
  - attack.t1543.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: 'SYSTEM\CurrentControlSet\Services\cldflt'
  filter_legit:
    Image|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\mmc.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrator reconfiguration of cloud sync services
level: high
---
title: MiniPlasma - Suspicious Handle Access to Cloud Filter Device
id: b1c2d3e4-5f6a-7890-1234-56789abcdef1
status: experimental
description: Detects non-system processes opening a handle to the Cloud Filter device (\Device\CldFlt) with suspicious access masks, indicative of exploit attempt.
references:
  - https://thehackernews.com/2026/05/miniplasma-windows-0-day-enables-system.html
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetObject|contains: '\Device\CldFlt'
    GrantedAccess|contains:
      - '0x1f0fff'
      - '0x1f1ff'
      - '0x1410' 
  filter_system:
    SubjectUserName: 'SYSTEM'
  condition: selection and not filter_system
falsepositives:
  - Legitimate backup software or cloud sync providers interacting with the driver
level: medium

// Hunt for registry modifications to the cldflt service
RegistryEvent
| where TimeGenerated > ago(7d)
| where Key contains "Services\\cldflt"
| where Process !in ("svchost.exe", "services.exe", "mmc.exe", "powershell.exe", "cmd.exe") 
   or (Process in ("powershell.exe", "cmd.exe") and InitiatingProcessAccountSid !in ("S-1-5-18", "S-1-5-32-544"))
| project TimeGenerated, Computer, Key, Value, ValueType, Process, Account, InitiatingProcessFileName
| extend MITRE_Tactic = "Privilege Escalation", MITRE_Technique = "Create or Modify System Process"

-- Hunt for processes holding handles on the Cloud Filter device
SELECT 
  Pid,
  Name,
  Username,
  CommandLine,
  Handles.Name AS HandleName,
  Handles.GrantAccess AS AccessMask
FROM pslist()
  JOIN handles ON Pid = handles.Pid
WHERE HandleName =~ '\Device\CldFlt'
  AND NOT Username =~ 'SYSTEM'
  AND NOT Name =~ 'explorer.exe' -- Filter common noise, tune as needed

<#
.SYNOPSIS
    Mitigation script for MiniPlasma (cldflt.sys) Zero-Day.
.DESCRIPTION
    This script checks the status of the Cloud Files Mini Filter Driver 
    and disables it to prevent privilege escalation attempts until a patch is released.
#>

Write-Host "[+] Checking status of cldflt service..."
$service = Get-Service -Name 'cldflt' -ErrorAction SilentlyContinue

if ($service) {
    if ($service.Status -eq 'Running') {
        Write-Host "[!] Service is currently Running. Stopping service..." -ForegroundColor Yellow
        Stop-Service -Name 'cldflt' -Force
    }
    
    Write-Host "[+] Setting service Startup Type to Disabled..."
    Set-Service -Name 'cldflt' -StartupType Disabled -ErrorAction Stop
    Write-Host "[SUCCESS] cldflt.sys driver disabled." -ForegroundColor Green
} else {
    Write-Host "[-] Service 'cldflt' not found on this system." -ForegroundColor Gray
}

# Verify state
Write-Host "[+] Verification:"
Get-Service -Name 'cldflt' -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType