MiniPlasma LPE - Windows privilege escalation

Shreyas Ravikumar@Heisenbergsrk

•updated May 21, 2026•48•1•881

Consolidated multi-stage detection for the MiniPlasma Local Privilege Escalation (LPE) flaw. Monitors for unauthorized low-privileged modifications to the NT AUTHORITY\SYSTEM (.DEFAULT) registry hive, anomalous non-system user interaction with the Windows Cloud Files Mini Filter Driver (cldflt.sys), and successful execution of an interactive SYSTEM command shell originating from a non-privileged account context.