In-the-Wild Windows LPE 0-days: Insights & Detection Strategies

This report reviews active, in-the-wild Windows local privilege escalation zero-days — focusing on CLFS, DWM/dwmcore, and Activation Context exploitation — and demonstrates detection and hunting techniques using Elastic Defend (EQL/KQL/ES|QL and YARA). It describes observed exploitation behaviors (e.g., low/medium integrity processes spawning SYSTEM children, shellcode/self-injection into dwm.exe, untrusted DLL loads by SYSTEM processes, kernel address corruption) and provides concrete detection queries and rules aimed at identifying these attack primitives and associated IOCs.