CldFlt Driver Load Correlated with SyncRootManager Registry Modification - CVE-2026-41091
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
Microsoft Sentinel (KQL)
