LPEClient/FudModule artifacts with afd.sys driver events (CVE-2026-68820)

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.