Loading story…
New analysis of CrowdStrike Falcon's Windows DirectoryCreate telemetry found the event is generated by the CSAgent.sys kernel minifilter at the IRP_MJ_CREATE layer, making it resistant to many user-mode evasion and path-obfuscation techniques. Testing across roughly 60 directory-creation methods showed the signal is dependable for true folder creation, including SMB-based creation that can produce both client-side and server-side events, but it records the resolved target path for junctions, symlinks, and bind links rather than the originally requested path.
The research also showed that directory renames, same-volume moves, and Recycle Bin restores do not trigger DirectoryCreate because they use rename semantics instead of create semantics, limiting the event's usefulness for some file-operation detections. That behavior aligns with a separate Windows Server 2022 file-share report in which files moved into a share by an automated process did not appear to clients until a manual refresh, suggesting rename-based operations can behave differently from true creates in both endpoint telemetry and SMB visibility; defenders are advised to correlate DirectoryCreate with ProcessRollup2 and parent-process context because the recorded actor may be an intermediary such as WmiPrvSE.exe, services.exe, or explorer.exe.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A Reddit user reported that after migrating a file server from Windows Server 2016 to Windows Server 2022, files moved into a shared folder by MOVEit did not appear in Windows 11 clients' File Explorer until users manually refreshed. The report said the issue occurred specifically for same-volume MOVEit moves that behave like rename operations, while drag-and-drop copies, SFTP uploads, and files created locally on the server appeared immediately.
The same research reported that directory creation through junctions, symlinks, and bind links is logged using the resolved target path rather than the requested path, which can affect detections based on request-path strings. It also found that SMB directory creation can produce both client-side and server-side events, and warned that DirectoryCreate should be correlated with ProcessRollup2 and related context because the recorded actor may reflect intermediary processes rather than the true initiator.
An analysis of CrowdStrike Falcon's Windows DirectoryCreate telemetry concluded that the event is generated by the CSAgent.sys minifilter at the IRP_MJ_CREATE layer, making it resilient to user-mode evasion and path obfuscation. Testing across roughly sixty directory-creation methods found that true creates are generally captured, while renames, moves, and Recycle Bin restores do not generate DirectoryCreate because they use rename rather than create semantics.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedetect.fyi
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of **UserAssist** and **AmCache**, showing how `shell32.dll` updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first `31,457,280` bytes of large files. Separate research showed that **Zsh session files** can preserve command evidence even when `.zsh_history` is deleted, and that binaries wrapped with **shc** or **AutoIT** often remain recoverable or observable through runtime artifacts rather than being truly opaque. Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, **`peritter`**, that dropped `OneDrive.exe` into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: **NSSM** was used to run payloads such as `ngrok` as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including **device discovery** and **Defender XDR deception accounts** generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Aug 10, 2026
Recent research shows attackers continue to rely on legitimate Windows administration features for lateral movement, with WMI, Scheduled Tasks, SMB admin shares, RDP, PsExec, and anomalous Kerberos activity remaining common across enterprise intrusions. VMware telemetry covering 489 multi-host intrusions found **44.7%** included lateral movement, typically across fewer than 20 hosts and using short, focused paths, while Gigamon detailed how remote WMI execution and Scheduled Tasks often blend into normal administration through DCE/RPC operations such as `ExecMethod`, `SchRpcRegisterTask`, `SchRpcRun`, and `SchRpcDelete`, frequently paired with SMB payload transfer and shared outbound command-and-control destinations. Newer Windows tradecraft is also exploiting **cross-session activation** and service manipulation to execute code under another user’s interactive session or persist more stealthily after compromise. Purple Team research described COM/DCOM abuse using `RunAs=Interactive User`, remote registry changes, and CLSID hijacking—including abuse of **SpeechRuntime.exe** via the CLSID `{655D9BF9-3876-43D0-B6E8-C83C1224154C}`—as well as tooling such as COMThanasia, PermissionHunter, SessionHop, and SpeechRuntimeMove; separate analysis showed attackers can evade simpler detections by abusing Windows Service recovery functions and registry-backed service creation. Across these techniques, defenders are urged to correlate process creation, registry access, service state changes, authentication context, and network telemetry, with attention to Windows events including **4688**, **4663**, **4657**, **7036**, and **7040**.
Aug 15, 2026
A researcher known as Chaotic Eclipse, Nightmare-Eclipse, MSNightmare, and INFINITE NIGHTMARE released **FalconFlank**, a public proof of concept claiming a zero-day local privilege-escalation flaw in the CrowdStrike Falcon Sensor. The technique allegedly abuses Falcon’s privileged remediation workflow for Microsoft Office files identified as containing malicious macros, potentially allowing a low-privileged local Windows user to execute in a more privileged—potentially `SYSTEM`—context. The researcher reported successful testing on fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon with **Phase 3 – Optimal Protection** and the Office macro-removal capability enabled. CrowdStrike had not published an advisory, CVE, patch, or confirmation at the time of reporting; affected versions, exploit reliability, prerequisites, and mitigations remain unverified. Organizations using the specified Falcon configuration should monitor for vendor guidance and investigate whether local-access threats could abuse the remediation feature.
Sep 9, 2026