MiniPlasma: detecting exploitation of a critical unpatched Windows vulnerability

Over the past two months, the anonymous researcher Nightmare Eclipse (also known as Chaotic Eclipse) has publicly disclosed six Windows vulnerabilities complete with ready-to-use exploits, without prior coordination with Microsoft. The most critical of these is MiniPlasma, a zero-day local privilege escalation exploit that grants attackers SYSTEM-level access.

In short

The exploit leverages an old flaw, CVE-2020-17103, which was believed to have been patched back in 2020. Fully updated systems running Windows 11, as well as Windows Server 2022 and 2025, are vulnerable to this attack vector.

Similar to CVE-2020-17103, the MiniPlasma issue is rooted in the Cloud Filter driver and the HsmOsBlockPlaceholderAccess routine.

According to Huntress Labs, attacks exploiting the initial vulnerabilities from the same list as MiniPlasma have been ongoing in the wild since April 10. It wasn’t until June 9 that Microsoft promised to release a patch for MiniPlasma.

Detection by Kaspersky solutions

Kaspersky Managed Detection and Response detects the exploitation of this vulnerability by tracking the following indicators of attack:

1. Creation of SymbolLinks in the registry key:
   HKU\\.DEFAULT\\Software\\Policies\\Microsoft\\CloudFiles\\BlockedApps:
   
   category: registry_set product: windows detection: selection: TargetObject|contains: 'Policies\\Microsoft\\CloudFiles\\BlockedApps' Details: 'SymbolicLinkValue' condition: selection

   1 2 3 4 5 6 7

   category: registry_set     product: windows detection:     selection:         TargetObject|contains: 'Policies\\Microsoft\\CloudFiles\\BlockedApps'         Details: 'SymbolicLinkValue'     condition: selection

2. Tracking the appearance of wermgr.exe outside standard paths:
   
   category: process_creation product: windows detection: selection: TargetFilename|endswith: '\\wermgr.exe' filter_system_locations: TargetFilename|startswith: - 'C:\\Windows\\System32\\' - 'C:\\Windows\\SysWOW64\\' - 'C:\\Windows\\WinSxS\\' - 'C:\\Windows\\servicing\\' - 'C:\\$WINDOWS.~BT\\' - 'C:\\Windows\\SoftwareDistribution\\' condition: selection and not filter_system_locations

   1 2 3 4 5 6 7 8 9 10 11 12 13 14

   category: process_creation     product: windows detection:     selection:         TargetFilename|endswith: '\\wermgr.exe'     filter_system_locations:         TargetFilename|startswith:             - 'C:\\Windows\\System32\\'             - 'C:\\Windows\\SysWOW64\\'             - 'C:\\Windows\\WinSxS\\'             - 'C:\\Windows\\servicing\\'             - 'C:\\$WINDOWS.~BT\\'             - 'C:\\Windows\\SoftwareDistribution\\'     condition: selection and not filter_system_locations

3. Execution of system binaries or their imitations from non-standard directories.
4. The analyzed PoC uses the .NET library NtApiDotNet by researcher James Forshaw to interact with registry Native APIs. The presence of artifacts or traces of this library’s usage is also an indicator of compromise.

To protect companies using our Kaspersky SIEM system or Kaspersky Extended Detection and Response, we have prepared a correlation rules package designed to detect such malicious activity. The rules are available to download from the products repository. For those developing custom detection rules or conducting threat hunting within a SIEM by analyzing Windows events, we recommend monitoring the following activities:

• Modification of the HKU\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps registry key by creating a symbolic link to HKU\.DEFAULT\Volatile Environment. To hunt for this, registry auditing (SACL) must be configured. KUMA query:
  
  DeviceEventClassID = '4657' AND FileName like '%Policies\Microsoft\CloudFiles\BlockedApps%' AND DeviceCustomString6 = 'SymbolicLinkValue'

  1	DeviceEventClassID = '4657' AND FileName like '%Policies\Microsoft\CloudFiles\BlockedApps%' AND DeviceCustomString6 = 'SymbolicLinkValue'

• Execution of the scheduled task \Microsoft\Windows\Windows Error Reporting\QueueReporting. To track Event ID 110, monitoring of the Microsoft-Windows-TaskScheduler/Operational log must be configured. KUMA query:
  
  DeviceEventClassID = '110' AND SourceProcessName = '\Microsoft\Windows\Windows Error Reporting\QueueReporting'

  1	DeviceEventClassID = '110' AND SourceProcessName = '\Microsoft\Windows\Windows Error Reporting\QueueReporting'

• Launching wermgr.exe from a non-standard directory (typically C:\Windows\(System32|SysWOW64), depending on the system. This activity is detected by the “R150_01_Start of a utility with the name of the system process from a folder other than the standard folder” rule, available in the KUMA repository. KUMA query:
  
  DeviceEventClassID = '4688' AND DestinationProcessName LIKE '%\wermgr.exe' AND NOT (DestinationProcessName = 'C:\Windows\System32\wermgr.exe' OR DestinationProcessName = 'C:\Windows\SysWOW64\wermgr.exe')

  1	DeviceEventClassID = '4688' AND DestinationProcessName LIKE '%\wermgr.exe' AND NOT (DestinationProcessName = 'C:\Windows\System32\wermgr.exe' OR DestinationProcessName = 'C:\Windows\SysWOW64\wermgr.exe')

• Execution of a non-standard process spawned by wermgr.exe. KUMA query:
  
  DeviceEventClassID = '4688' AND SourceProcessName LIKE '%\wermgr.exe'

  1	DeviceEventClassID = '4688' AND SourceProcessName LIKE '%\wermgr.exe'

Note: The provided search queries are applicable when using the default normalizer. We recommend a search depth of at least one month.

The exploitation of the MiniPlasma vulnerability using the published PoC is successfully detected by Kaspersky Next EDR Expert and Kaspersky Extended Detection and Response via the following rules:

1. Detection of SymbolLinks creation in the \Software\Policies\Microsoft\CloudFiles\BlockedApps key via the suspicious_modification_cloudfiles_symbolic_link_reg rule:
2. Detection of system utilities appearing outside system directories via the create_file_named_like_system_tool_in_wrong_place rule:
3. Detection of system binary execution from non-standard directories via the executing_file_named_like_system_tool_in_wrong_place rule:
4. Detection of .NET library loading from non-standard directories via the load_dotnet_library_by_process_from_non_standard_directory rule: