Windows SignDrop Zero-Day Grants SYSTEM Privileges: Detection, Hardening, and Mitigation Guide for Defenders

---
title: Suspicious File Creation in Protected Windows Directory by Non-Privileged Process
id: 8b2c4d6e-1a3f-4b5c-9d7e-2f4a6c8e0b1d
status: experimental
description: Detects file creation events in privileged Windows directories (System32, SysWOW64, WinSxS-adjacent paths) by processes that do not normally write there. SignDrop-style LPE exploits coerce privileged components into dropping attacker payloads in these locations.
references:
  - https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  filter_software_installers:
    Image|contains:
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'
      - '\svchost.exe'
      - '\WindowsUpdate'
      - '\dism.exe'
      - '\sfc.exe'
  filter_legit_updaters:
    Image|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_path and not filter_software_installers and not filter_legit_updaters
falsepositives:
  - Legitimate software installers running from temp directories
  - Enterprise software distribution tools (SCCM, Intune) writing drivers or system components
level: high
---
title: SYSTEM-Context Execution of Binary from User-Writable or Temp Location
id: 3f7a9c1e-5d2b-4e8f-a6c0-7b9d1e3f5a2c
status: experimental
description: Detects processes running as SYSTEM with executable paths in user-writable or temporary directories. SignDrop and similar LPE chains frequently result in attacker payloads planted in writable locations being executed by privileged services or scheduled tasks.
references:
  - https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1053/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  selection_path:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Windows\Temp\'
      - '\ProgramData\'
      - '\$Recycle.Bin\'
      - '\PerfLogs\'
  filter_programdata_known:
    Image|contains:
      - '\ProgramData\Microsoft\'
      - '\ProgramData\Package Cache\'
  condition: selection_user and selection_path and not filter_programdata_known
falsepositives:
  - Enterprise deployment agents running from ProgramData
  - Legitimate scheduled tasks installed by line-of-business software
level: high
---
title: Scheduled Task Registration Pointing to User-Writable Payload
id: 6e1b3d5f-8a2c-4f7b-b9e0-1c4d6e8a0b3f
status: experimental
description: Detects creation of scheduled tasks whose action executable resides in a user-writable path. A common SignDrop post-exploitation persistence and elevation mechanism is registering a task running as SYSTEM that launches the planted payload.
references:
  - https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/
  - https://attack.mitre.org/techniques/T1053.005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\schtasks.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_args:
    CommandLine|contains:
      - '/create'
      - 'Register-ScheduledTask'
  selection_path:
    CommandLine|contains:
      - 'Users\Public'
      - 'AppData\Local\Temp'
      - 'Windows\Temp'
      - '$env:TEMP'
      - 'ProgramData'
  filter_admin_activity:
    CommandLine|contains:
      - 'ProgramData\Microsoft'
  condition: selection_tool and selection_args and selection_path and not filter_admin_activity
falsepositives:
  - Software installers creating update tasks
  - IT automation scripts deploying scheduled tasks
level: medium

// Hunt for SYSTEM-context execution from user-writable/temp paths (SignDrop post-exploitation pattern)
let Lookback = 7d;
let SuspiciousPaths = dynamic([@"\Users\Public\", @"\AppData\Local\Temp\", @"\Windows\Temp\", @"\ProgramData\", @"\PerfLogs\", @"\$Recycle.Bin\"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where AccountName in~ ("system", "local service", "network service")
| where FolderPath has_any (SuspiciousPaths)
| where FolderPath !has @"\ProgramData\Microsoft\"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any (@"\Windows\System32\", @"\Windows\SysWOW64\")
    | where ActionType == "FileCreated"
    | where InitiatingProcessFolderPath !has_any (@"\Windows\System32\", @"\Windows\ servicing\")
    | project FileCreatedTime=TimeGenerated, DeviceName, DroppedFile=FileName, DroppedTo=FolderPath, DroppingProcess=InitiatingProcessFileName
) on DeviceName
| project-reorder TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, DroppingProcess, DroppedFile, DroppedTo
| sort by TimeGenerated desc

// File creations in protected directories by processes outside trusted OS paths
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath has_any (@"C:\Windows\System32\", @"C:\Windows\SysWOW64\")
| where InitiatingProcessFolderPath !startswith @"C:\Windows\"
| where InitiatingProcessFolderPath !startswith @"C:\Program Files"
| summarize FileCount=count(), Files=make_set(FileName, 10), DroppedPaths=make_set(FolderPath, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| sort by FileCount desc

-- SignDrop LPE hunt: recent file drops in protected dirs + SYSTEM processes from odd paths
LET protected_drops = SELECT FullPath, Mtime, Size,
       upload(accessor="ntfs", path=FullPath) as FileAvailable
FROM glob(globs=[
  "C:/Windows/System32/*.dll",
  "C:/Windows/System32/*.exe",
  "C:/Windows/SysWOW64/*.dll"
])
WHERE Mtime > now() - 604800

LET system_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Username =~ 'SYSTEM|LOCAL SERVICE|NETWORK SERVICE'
  AND Exe =~ '(?i)(Users.Public|AppData.Local.Temp|Windows.Temp|ProgramData|PerfLogs)'
  AND Exe !~ '(?i)ProgramData.Microsoft'

SELECT * FROM protected_drops
UNION ALL
SELECT FullPath=NULL, Mtime=CreateTime, Size=NULL, FileAvailable=NULL,
       Pid=Pid, Name=Name, Exe=Exe, CommandLine=CommandLine, Username=Username
FROM system_procs

# SignDrop exposure audit - run elevated via RMM/Intune/SCCM across the fleet
$report = [ordered]@{}

# 1. Recently created unsigned binaries in protected directories (last 7 days)
$cutoff = (Get-Date).AddDays(-7)
$suspiciousDrops = Get-ChildItem -Path "$env:SystemRoot\System32","$env:SystemRoot\SysWOW64" -Include *.dll,*.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt $cutoff } |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        [PSCustomObject]@{
            Path      = $_.FullName
            Created   = $_.CreationTime
            Signed    = $sig.Status
            Signer    = $sig.SignerCertificate.Subject
        }
    } | Where-Object { $_.Signed -ne 'Valid' -or $_.Signer -notmatch 'Microsoft' }
$report['UnsignedDropsInProtectedDirs'] = $suspiciousDrops

# 2. Scheduled tasks running as SYSTEM with actions in writable paths
$writablePaths = 'Users\Public|AppData\Local\Temp|Windows\Temp|ProgramData|PerfLogs'
$riskyTasks = Get-ScheduledTask | Where-Object {
    $_.Principal.UserId -match 'SYSTEM|LOCAL SERVICE|NETWORK SERVICE' -and
    ($_.Actions | Where-Object { $_.Execute -match $writablePaths })
} | Select-Object TaskName, TaskPath, @{N='Action';E={($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '}}
$report['RiskySystemTasks'] = $riskyTasks

# 3. Verify Microsoft Defender Attack Surface Reduction rule state (block untrusted/unsigned processes from USB and Office child processes as baseline)
$asrRules = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
$asrActions = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions
$report['ASRConfigured'] = ($asrRules.Count -gt 0)

# 4. Verify WDAC / AppLocker enforcement presence
$wdac = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
$report['WDAC_Enforced'] = ($wdac.CodeIntegrityPolicyEnforcementStatus -eq 2)
$applocker = Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue
$report['AppLockerPresent'] = ($null -ne $applocker)

# 5. Recent local privilege escalation indicators: non-admin users added to local Administrators
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass, PrincipalSource
$report['LocalAdmins'] = $admins

$report | ConvertTo-Json -Depth 5 | Out-File "$env:ProgramData\SignDrop_Audit_$(Get-Date -Format yyyyMMdd_HHmmss).json"
Write-Output "Audit complete. Review output JSON in $env:ProgramData."