CVE-2024-49138

Summary

Windows Common Log File System Driver Elevation of Privilege Vulnerability

• CVE-2024-49138-POCExploit

  Proof-of-concept exploit for CVE-2024-49138 in Windows CLFS.sys, achieving local privilege escalation to system shell via token manipulation.

• SOC335-CVE-2024-49138-Exploitation-DetectedResearch

  Detailed incident response walkthrough analyzing CVE-2024-49138 exploitation on Windows, covering process tree analysis, IOC identification, and MITRE ATT&CK mapping for detection and mitigation.

• SOC335-CVE-2024-49138-Exploitation-DetectedResearch

  Documented incident response case for CVE-2024-49138 exploitation, featuring log analysis, hash validation, C2 detection, and containment procedures for SOC training.

• CVE-2024-49138-POCExploit

  POC exploit for CVE-2024-49138

• CVE-2024-49138-SOC-InvestigationResearch

  SOC investigation of CVE-2024-49138 exploitation involving brute-force activity, PowerShell execution, malicious payload analysis, privilege escalation, and incident response.

• SOC-Investigation-CVE-2024-49138Informational

  Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)

• WinDriver-EXPPoC

  This repo contains PoCs for vulnerable Windows drivers.

• SOC335-CVE-2024-49138-InvestigationResearch

  SOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.

• CVE-2024-49138PoC

  Proof-of-concept exploit for CVE-2024-49138, demonstrating a local privilege escalation vulnerability in Windows Kernel-Mode Driver (win32k.sys).

• Microsoft Windows 11 23h2 - CLFS.sys Elevation of PrivilegeExploit

  Milad karimi · windows · Apr 22, 2025