Anomalous Cloud Files Sync Root Registration

Elgonad .@elgonad

•updated Apr 9, 2026•20•0•1,407

Detects the usage of Cloud Files API (CfRegisterSyncRoot or CfConnectSyncRoot) by untrusted applications. This technique is notably used by the BlueHammer LPE zero-day to set a timing trap and freeze Windows Defender.