SecBoard
Zurück zur CVE-Übersicht

CVE-2026-82964

HIGH(8.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM. The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.

Erkennung & Indikatoren

Ausnutzung

A public Proof-of-Concept (PoC) exists that demonstrates a SAM database dump and elevation of privilege. The PoC is compatible with any version of Avast Antivirus and works with fully patched Avast Antivirus + Patched Windows 11 25H2.

Threat-Hunting-Queries

Detect attempts by low-privileged processes within a sandbox environment to access or modify sensitive system files (e.g., SAM database) or to spawn a SYSTEM shell. This behavior is indicative of a sandbox escape and privilege escalation.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "AvastSandbox" or InitiatingProcessParentCommandLine contains "AvastSandbox"
| where FileName in ("cmd.exe", "powershell.exe") and ProcessCommandLine contains "SYSTEM"
| where ProcessCommandLine contains "sam.sav" or ProcessCommandLine contains "security.sav" or ProcessCommandLine contains "system.sav"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

(sourcetype="WinEventLog:Security" EventCode=4688 NewProcessName IN ("cmd.exe", "powershell.exe") CommandLine=*SYSTEM*) OR (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image IN ("cmd.exe", "powershell.exe") CommandLine=*SYSTEM*)
| search (ParentCommandLine=*AvastSandbox* OR CommandLine=*AvastSandbox*)
| search (CommandLine=*sam.sav* OR CommandLine=*security.sav* OR CommandLine=*system.sav*)
| table _time, Host, ParentProcessName, ParentCommandLine, NewProcessName, CommandLine

Sigma

title: Avast Sandbox Escape - Privilege Escalation
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to escape the Avast sandbox and escalate privileges by dumping the SAM database or spawning a SYSTEM shell.
references:
  - https://github.com/MSNightmare/PrettyPrague
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains: 'AvastSandbox'
    CommandLine|contains:
      - 'SYSTEM'
      - 'sam.sav'
      - 'security.sav'
      - 'system.sav'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
level: high

Elastic ES|QL

from process where 
  (process.parent.command_line : "*AvastSandbox*" or process.command_line : "*AvastSandbox*") and 
  (process.command_line : "*SYSTEM*" or process.command_line : "*sam.sav*" or process.command_line : "*security.sav*" or process.command_line : "*system.sav*") and 
  (process.executable.name : "cmd.exe" or process.executable.name : "powershell.exe")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Sonstige (1)

  • https://github.com/MSNightmare/PrettyPrague

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen