ZDI-26-615: Unpatched PDF Architect Privilege Escalation — Detection and Mitigation Guide

---
title: DLL Planted in pdfforge PDF Architect Directory by Non-System Process
id: 3f8c2a91-6d4e-4b7a-9c21-5e7f0a8b1d33
status: experimental
description: Detects creation of DLL files in PDF Architect installation or service directories by processes other than trusted installers, consistent with DLL search-order hijacking against the activation/update service (ZDI-26-615).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-615/
  - https://attack.mitre.org/techniques/T1574/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\pdfforge\'
      - '\PDF Architect\'
      - '\PDFArchitect\'
  selection_ext:
    TargetFilename|endswith: '.dll'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\TrustedInstaller.exe'
      - '\PDF Architect\Setup.exe'
  filter_system:
    User|contains: 'SYSTEM'
  condition: selection_path and selection_ext and not 1 of filter_*
falsepositives:
  - Legitimate vendor updates deploying new modules (filter on signed updater processes once confirmed)
  - Software deployment tools (SCCM/Intune) — tune by Image
description_fp: Tune installer filters to your software deployment tooling after baseline.
level: high
---
title: PDF Architect Service Spawning Command Interpreter or Script Host
id: 9b1e4d72-3a58-4f6c-8d02-7c5e9a0b2f44
status: experimental
description: Detects the PDF Architect activation/update service or main process spawning cmd, PowerShell, rundll32, or other LOLBins — a strong post-exploitation signal after SYSTEM-level code execution via DLL hijack (ZDI-26-615).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-615/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\pdfforge\'
      - '\PDF Architect\'
      - '\PDFArchitect\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — vendor updaters occasionally invoke shells for post-install tasks; validate against signed vendor binaries and known update windows
level: critical
---
title: Service Executable Running from User-Writable Path Referencing PDF Architect
id: 5d2a7f18-8c43-4e19-b630-1f4a6c9d3e55
status: experimental
description: Detects service control manager launching binaries from user-profile or temp paths with PDF Architect-related names, indicating a hijacked or impersonated activation/update service.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-615/
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1574
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
  selection_name:
    Image|contains:
      - 'pdfarchitect'
      - 'activation'
      - 'pdfforge'
  condition: selection_path and selection_name
falsepositives:
  - User-context PDF Architect components legitimately installed per-user — verify install scope in your environment
level: high

// ZDI-26-615 hunt: DLL planting + suspicious service children for PDF Architect
let pdfforgePaths = dynamic(["pdfforge", "PDF Architect", "PDFArchitect"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "net.exe", "net1.exe"]);
let dllDrops =
  DeviceFileEvents
  | where TimeGenerated > ago(14d)
  | where FolderPath has_any (pdfforgePaths) and FileName endswith ".dll"
  | where InitiatingProcessFileName !in~ ("msiexec.exe", "trustedinstaller.exe")
  | where InitiatingProcessAccountName !~ "system"
  | project DropTime=TimeGenerated, DeviceName, FolderPath, FileName,
            DroppedBy=InitiatingProcessFileName, DropAccount=InitiatingProcessAccountName,
            SHA256, ReportId;
let serviceChildren =
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where InitiatingProcessFolderPath has_any (pdfforgePaths)
  | where FileName in~ (suspiciousChildren)
  | project SpawnTime=TimeGenerated, DeviceName, ServiceProcess=InitiatingProcessFileName,
            ServiceAccount=InitiatingProcessAccountName, ChildProcess=FileName,
            ChildCommandLine=ProcessCommandLine, ReportId;
dllDrops
| join kind=fullouter serviceChildren on DeviceName
| order by DeviceName asc, DropTime asc

SecurityEvent
| where EventID == 4688
| where TimeGenerated > ago(14d)
| where ParentProcessName has_any ("pdfforge", "PDF Architect", "PDFArchitect")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "rundll32.exe", "mshta.exe", "wmic.exe", "net.exe")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, AccountName
| order by TimeGenerated desc

-- ZDI-26-615: Inventory PDF Architect service + hunt planted DLLs
LET service = SELECT Name, DisplayName, PathName, StartName, State
FROM wmi(query="SELECT Name, DisplayName, PathName, StartName, State FROM Win32_Service WHERE PathName LIKE '%PDF Architect%' OR PathName LIKE '%pdfforge%' OR DisplayName LIKE '%PDF Architect%'")

LET dlls = SELECT FullPath, Size, Mtime,
           Authenticode.Description AS Signature,
           Authenticode.Status AS SignatureStatus
FROM glob(globs=[
  'C:/Program Files/pdfforge/**/*.dll',
  'C:/Program Files (x86)/pdfforge/**/*.dll',
  'C:/Program Files/PDF Architect*/**/*.dll',
  'C:/Program Files (x86)/PDF Architect*/**/*.dll'
])
WHERE NOT SignatureStatus =~ 'OK'
   OR NOT Signature =~ 'pdfforge'

SELECT * FROM service
UNION ALL
SELECT FullPath AS Name, Signature AS DisplayName, FullPath AS PathName,
       SignatureStatus AS StartName, Mtime AS State
FROM dlls

# ZDI-26-615 — PDF Architect uncontrolled search path mitigation
# Audit and harden ACLs on pdfforge PDF Architect install directories.
# Usage: run -AuditOnly first; then re-run with -Enforce to remediate.

[CmdletBinding()]
param(
    [switch]$AuditOnly,
    [switch]$Enforce
)

$report = @()

# 1. Locate PDF Architect services and install paths
$services = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'pdfforge|PDF Architect' -or $_.DisplayName -match 'PDF Architect'
}

if (-not $services) {
    Write-Host "[+] No PDF Architect services found on this host." -ForegroundColor Green
    exit 0
}

foreach ($svc in $services) {
    $report += [PSCustomObject]@{
        Type        = 'Service'
        Name        = $svc.Name
        DisplayName = $svc.DisplayName
        RunAs       = $svc.StartName
        State       = $svc.State
        BinaryPath  = $svc.PathName
        Issue       = if ($svc.StartName -match 'LocalSystem|SYSTEM') { 'Runs as SYSTEM — high-impact LPE target' } else { 'Review run-as account' }
    }
    Write-Host "[!] Service: $($svc.Name) | Runs as: $($svc.StartName) | $($svc.State)" -ForegroundColor Yellow
}

# 2. Enumerate install directories
$installRoots = @(
    "$env:ProgramFiles\pdfforge",
    "${env:ProgramFiles(x86)}\pdfforge"
) + (Get-ChildItem "$env:ProgramFiles","${env:ProgramFiles(x86)}" -Directory -Filter 'PDF Architect*' -ErrorAction SilentlyContinue).FullName

foreach ($root in ($installRoots | Where-Object { $_ -and (Test-Path $_) })) {
    $acl = Get-Acl $root
    $writable = $acl.Access | Where-Object {
        $_.FileSystemRights -match 'Write|Modify|FullControl' -and
        $_.IdentityReference -notmatch 'SYSTEM|Administrators|TrustedInstaller' -and
        $_.AccessControlType -eq 'Allow'
    }

    foreach ($entry in $writable) {
        $report += [PSCustomObject]@{
            Type        = 'WeakACL'
            Name        = $root
            DisplayName = $entry.IdentityReference
            RunAs       = ''
            State       = ''
            BinaryPath  = $entry.FileSystemRights
            Issue       = 'Non-admin principal has write access — DLL plant possible'
        }
        Write-Host "[VULN] $($entry.IdentityReference) has $($entry.FileSystemRights) on $root" -ForegroundColor Red
    }

    # 3. Harden: strip non-admin write/modify ACEs (inheritance-preserved admin/system ACEs stay)
    if ($Enforce -and $writable) {
        foreach ($entry in $writable) {
            $acl.RemoveAccessRule($entry) | Out-Null
        }
        Set-Acl -Path $root -AclObject $acl
        Write-Host "[FIXED] Hardened ACLs on $root" -ForegroundColor Green
    }
}

# 4. Check for suspicious unsigned DLLs already present
$planted = foreach ($root in $installRoots) {
    if ($root -and (Test-Path $root)) {
        Get-ChildItem $root -Recurse -Filter *.dll -ErrorAction SilentlyContinue | Where-Object {
            (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid'
        }
    }
}
foreach ($dll in $planted) {
    $report += [PSCustomObject]@{
        Type='UnsignedDLL'; Name=$dll.FullName; DisplayName=''; RunAs=''; State='';
        BinaryPath=''; Issue='Unsigned DLL in install path — investigate immediately'
    }
    Write-Host "[ALERT] Unsigned DLL: $($dll.FullName)" -ForegroundColor Red
}

$report | Export-Csv -Path "$env:TEMP\ZDI-26-615-audit-$(Get-Date -Format yyyyMMdd-HHmm).csv" -NoTypeInformation
Write-Host "`nReport written to $env:TEMP. Re-run with -Enforce to apply ACL hardening." -ForegroundColor Cyan