According to the researcher's GitHub README, FalconFlank abuses a flaw in how CrowdStrike Falcon Sensor handles remediation of malicious Office macros, allowing an attacker to escalate privileges on the target system. The disclosure includes a working PoC, which raises practical concerns for organizations relying on CrowdStrike's EDR product for endpoint defense.

Key technical details from the advisory:

• The vulnerability is a local privilege escalation flaw, not a remote code execution vector.
• The attack chain requires an initial foothold on the affected host, such as through a standard user session or malware execution.
• The abuse relies on the macro remediation logic, meaning environments with strict macro-blocking policies may have a reduced attack surface, though the specific trigger conditions are not fully detailed in the public release.

No vendor patch or official mitigation has been announced at the time of writing. Organizations running CrowdStrike Falcon Sensor should monitor vendor advisories and consider restricting local macro-handling features where feasible. As with any public PoC, administrators are advised to assume active exploitation attempts in the wild and review detection rules for anomalous sensor behavior.

Source: The Hacker News

Is your organization currently running CrowdStrike Falcon, and how are you planning to assess exposure to this local privilege escalation vector before an official patch lands?