Posted on

Kaspersky Endpoint Security HardBreacher – Public Privilege Escalation PoC Hunt

Threat Overview

HardBreacher is the name given by researcher Nightmare Eclipse to a publicly released proof-of-concept targeting Kaspersky Endpoint Security for Windows. SecurityWeek reported the PoC on August 31, 2026. Kaspersky subsequently published a vendor advisory confirming that it fixed the issue described by the HardBreacher research.

Kaspersky states that the issue could have caused partial degradation of application functionality and that the fix is delivered through antivirus databases. The affected vendor-confirmed scope is Kaspersky Endpoint Security for Windows 14.0 and 14.1. The fixed state is those same product versions with antivirus databases released August 30, 2026 or later.

The researcher described the PoC as unstable and claimed it could abuse the Kaspersky UI process to interfere with file-access decisions. Public reporting on the repository states that a successful test created C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with permissions granted to the current unprivileged user. That filename is a research artifact, not evidence of real-world malicious exploitation.

No CVE was assigned in the Kaspersky advisory reviewed for this report, and no confirmed in-the-wild exploitation was identified. The security significance is the availability of public local privilege-escalation code against a highly privileged endpoint security product.

References

Impacted Systems

  • Vendor/product: Kaspersky Endpoint Security for Windows.
  • Vendor-confirmed affected versions: 14.0 and 14.1.
  • Fixed state: versions 14.0 and 14.1 with antivirus databases released August 30, 2026 or later.
  • Platform: Windows endpoints.
  • Researcher-tested configuration: Windows 11 25H2 with Kaspersky Endpoint Security 14.0.0.504, according to public reporting on the PoC.
  • Attacker prerequisite: local execution or local user access. This is not a remote initial-access vulnerability.
  • Exposure condition: vulnerable Kaspersky Endpoint Security database/update state on a compromised or locally accessible Windows endpoint.
  • CVE: none listed in the reviewed Kaspersky advisory.
  • Research artifact: C:\Windows\System32\MY_SNAKE_IS_SOLID.dll.

Why this matters

Public exploit code is available for a privilege-escalation path involving endpoint security software. Local privilege escalation can materially increase the impact of phishing malware, stolen-user sessions, malicious installers, or other initial footholds. Kaspersky has already shipped a database-based fix, making update-state validation a high-priority customer action.

Exploitation Status

No confirmed malicious exploitation was identified in the reviewed reporting. Public PoC code is available. Kaspersky confirms the underlying issue described by the research and states it is mitigated by antivirus databases released August 30, 2026 or later.

What this hunt looks for

The published research artifact, Kaspersky processes writing DLLs into protected Windows paths, Kaspersky process-to-shell activity, ACL modification utilities targeting System32, and short-window protected-path file creation around Kaspersky process activity.

Required logs

  • DeviceFileEvents
  • DeviceProcessEvents
  • SecurityEvent Event ID 4688 fallback

Hunt 1 – First-Pass: HardBreacher Research Artifact

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "MY_SNAKE_IS_SOLID.dll"
| where FolderPath startswith @"C:\Windows\System32"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 2 – Kaspersky Processes Writing New DLLs Into System32

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath startswith @"C:\Windows\System32"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FileName endswith ".dll"
| where InitiatingProcessFileName in~ ("avp.exe","avpui.exe")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 3 – Kaspersky UI or Service Process Spawning Shells

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("avp.exe","avpui.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 4 – Protected-Path ACL Modification Utilities

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("icacls.exe","takeown.exe","cacls.exe")
| where ProcessCommandLine has_any (@"C:\Windows\System32", "MY_SNAKE_IS_SOLID.dll")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 5 – New Executable Content in System32 Around Kaspersky Activity

let KasperskyActivity = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("avp.exe","avpui.exe") or InitiatingProcessFileName in~ ("avp.exe","avpui.exe")
| project DeviceId, KasperskyTime=TimeGenerated;
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath startswith @"C:\Windows\System32"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FileName endswith ".dll" or FileName endswith ".exe"
| join kind=inner KasperskyActivity on DeviceId
| where TimeGenerated between (KasperskyTime - 5m .. KasperskyTime + 5m)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, KasperskyTime
| sort by TimeGenerated asc

Hunt 6 – SecurityEvent 4688 Fallback for Kaspersky-to-Shell Execution

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName has_any ("avp.exe","avpui.exe")
| where NewProcessName has_any ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Detection Notes

  • The exact MY_SNAKE_IS_SOLID.dll filename is the highest-fidelity published research indicator but is specific to the PoC and should not be treated as a universal malicious artifact.
  • Kaspersky process names such as avp.exe and avpui.exe are legitimate. Results become meaningful when associated with unexpected protected-path writes or shell execution.
  • The vendor describes the issue more narrowly as potential partial degradation of application functionality, while the researcher claims a privilege-escalation outcome. That distinction is important.
  • Public PoC availability increases weaponization risk, but no confirmed in-the-wild malicious use was identified in reviewed sources.
  • DeviceFileEvents and DeviceProcessEvents require endpoint telemetry ingested into Sentinel. The SecurityEvent fallback requires Event ID 4688 with command-line auditing.

Leave a comment