Nightmare Eclipse Releases Unpatched Privilege Escalation Exploits for CrowdStrike, Nvidia, and Avast — Defender's Detection and Hardening Guide

---
title: Security Product or Nvidia Component Spawning Shell or Script Interpreter
id: 3f8a2c1d-9b47-4e56-a12c-8d0e5f7a9b31
status: experimental
description: Detects cmd.exe, PowerShell, or other script interpreters spawned by CrowdStrike Falcon, Avast, or Nvidia processes. Security products and GPU service components should never launch interactive shells — this is a strong indicator of privilege escalation exploitation such as the Nightmare Eclipse PoCs yielding SYSTEM shells.
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parents:
    ParentImage|endswith:
      - '\CSFalconService.exe'
      - '\CSFalconContainer.exe'
      - '\AvastSvc.exe'
      - '\AvastUI.exe'
      - '\aswVmm.exe'
      - '\nvcontainer.exe'
      - '\NVDisplay.Container.exe'
      - '\nvtelemetrycontainer.exe'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
  condition: selection_parents and selection_children
falsepositives:
  - Rare vendor self-update or telemetry mechanisms — validate against vendor documentation before tuning
level: critical
---
title: Interactive Shell Running as SYSTEM via Unusual Parent
id: 6c1e9d04-2f83-4a7b-b91d-4e6f8a2c5d07
status: experimental
description: Detects interactive command shells executing as NT AUTHORITY\SYSTEM where the parent process is not a known system component. Public LPE exploits such as the Nightmare Eclipse releases produce a SYSTEM shell whose parent lineage is abnormal.
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_system:
    User: 'NT AUTHORITY\SYSTEM'
  filter_parents:
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
      - '\wininit.exe'
      - '\winlogon.exe'
      - '\MsMpEng.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\smss.exe'
      - '\csrss.exe'
      - '\spoolsv.exe'
      - '\wmiprvse.exe'
      - '\taskeng.exe'
      - '\taskhostw.exe'
  condition: selection_shell and selection_system and not filter_parents
falsepositives:
  - Legitimate administrative tooling (SCCM, PSExec-style remote management, EDR response shells) — tune per environment by parent process and command line
level: high
---
title: Suspicious Kernel Driver Load from User-Writable Path
id: 9d4b7e21-6a35-4c18-f2a9-7b3e0d8c1a46
status: experimental
description: Detects service creation or driver load attempts where the driver image resides in a user-writable or temp directory — consistent with exploitation staging for driver-based privilege escalation and potential follow-on BYOVD activity after gaining SYSTEM.
references:
  - https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1543.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'create'
      - ' type= kernel'
  selection_path:
    CommandLine|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
      - 'Desktop'
  condition: selection and selection_path
falsepositives:
  - Legitimate driver installation by IT — correlate with software inventory and change tickets
level: high

// Hunt for privilege-escalation indicators tied to CrowdStrike, Avast, or Nvidia exploitation
// Focus: shells/script interpreters spawned by security-product or Nvidia components, and SYSTEM shells with anomalous parents
let Lookback = 7d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","wmic.exe"]);
let AffectedParents = dynamic(["CSFalconService.exe","CSFalconContainer.exe","AvastSvc.exe","AvastUI.exe","aswVmm.exe","nvcontainer.exe","NVDisplay.Container.exe","nvtelemetrycontainer.exe"]);
union isfuzzy=true
(
  DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where InitiatingProcessFileName in~ (AffectedParents)
  | where FileName in~ (SuspiciousChildren)
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
),
(
  SecurityEvent
  | where TimeGenerated > ago(Lookback)
  | where EventID == 4688
  | where ParentProcessName has_any (AffectedParents)
  | where NewProcessName has_any (SuspiciousChildren)
  | project TimeGenerated, Computer, SubjectAccount, ParentProcessName, NewProcessName, CommandLine
)
| order by TimeGenerated desc;

// Secondary hunt: SYSTEM shells with unusual parent processes
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
| where AccountName =~ "system"
| where InitiatingProcessFileName !in~ ("services.exe","svchost.exe","wininit.exe","winlogon.exe","MsMpEng.exe","msiexec.exe","TiWorker.exe","smss.exe","csrss.exe","spoolsv.exe","wmiprvse.exe","taskhostw.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

-- Hunt: Privilege escalation outcome — shells parented to CrowdStrike/Avast/Nvidia processes
-- plus suspicious driver staging in user-writable paths
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe'
   AND Username =~ '(?i)SYSTEM')
   OR Exe =~ '(?i)CSFalconService|AvastSvc|nvcontainer'

-- Follow-up: hunt for recently created driver files outside System32\drivers
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/AppData/**/*.sys',
                 'C:/Windows/Temp/*.sys',
                 'C:/ProgramData/**/*.sys',
                 'C:/Users/Public/*.sys'])
WHERE Mtime > (timestamp(epoch=now() - 7*24*3600))
ORDER BY Mtime DESC

# Nightmare Eclipse Exposure — Compensating Controls & Audit Script
# Run elevated. Review output before enforcing changes in production.

# 1) Verify Microsoft Vulnerable Driver Blocklist is enforced (blocks known-abused drivers)
$msipath = 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config'
$vdl = Get-ItemProperty -Path $msipath -Name 'VulnerableDriverBlocklistEnable' -ErrorAction SilentlyContinue
if ($vdl.VulnerableDriverBlocklistEnable -ne 1) {
    Write-Host '[!] Vulnerable Driver Blocklist NOT enforced — enabling (requires reboot)' -ForegroundColor Yellow
    Set-ItemProperty -Path $msipath -Name 'VulnerableDriverBlocklistEnable' -Value 1
} else {
    Write-Host '[+] Vulnerable Driver Blocklist is enforced.' -ForegroundColor Green
}

# 2) Confirm HVCI / Memory Integrity status (blocks unsigned/vulnerable kernel drivers)
$hvci = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($hvci.SecurityServicesRunning -contains 2) {
    Write-Host '[+] Memory Integrity (HVCI) is running.' -ForegroundColor Green
} else {
    Write-Host '[!] Memory Integrity (HVCI) not running — enable via GPO/Intune: Device Guard > Hypervisor-Protected Code Integrity' -ForegroundColor Yellow
}

# 3) Enumerate unsigned or suspicious kernel drivers currently loaded
Write-Host '`n[*] Scanning loaded drivers for unsigned / non-standard images...'
Get-CimInstance Win32_SystemDriver | Where-Object { $_.State -eq 'Running' -and $_.PathName } | ForEach-Object {
    $path = $_.PathName -replace '\\??\\',''
    $sig = Get-AuthenticodeSignature -FilePath $path -ErrorAction SilentlyContinue
    if ($sig.Status -ne 'Valid') {
        Write-Host ("[!] Unsigned/invalid driver: {0} -> {1} (Status: {2})" -f $_.Name, $path, $sig.Status) -ForegroundColor Red
    }
}

# 4) Audit for exploitation outcome: driver files dropped in user-writable paths in last 14 days
$cutoff = (Get-Date).AddDays(-14)
$searchPaths = @("$env:SystemDrive\Users", "$env:ProgramData", "$env:SystemRoot\Temp")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -Filter *.sys -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt $cutoff } |
        ForEach-Object { Write-Host ("[!] Recent driver file: {0} (Created: {1})" -f $_.FullName, $_.CreationTime) -ForegroundColor Red }
}

# 5) Verify tamper protection posture (Defender) — third-party AV/EDR equivalents must be checked in their consoles
$mp = Get-MpPreference -ErrorAction SilentlyContinue
if ($mp) {
    Write-Host ('[*] Defender Tamper Protection state (check Get-MpComputerStatus for IsTamperProtected):')
    Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled, AntivirusEnabled | Format-List
}

# 6) Inventory affected product versions for patch-readiness tracking
Write-Host '`n[*] Installed versions of affected product families:'
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'CrowdStrike|Falcon|Avast|NVIDIA' } |
    Select-Object Name, Version | Format-Table -AutoSize
# Faster alternative if Win32_Product is too slow:
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'CrowdStrike|Falcon|Avast|NVIDIA' } |
    Select-Object DisplayName, DisplayVersion | Format-Table -AutoSize