Jeff Moss on Nostr: “FalconFlank is a 0day privilege escalation that abuses the office malicious macros ...
“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it . . .” Sounds like another race to update.
https://github.com/MSNightmare/FalconFlank#InfoSec #cybersecurity
Published at
2026-09-03 10:52:05 UTCEvent JSON
{
"id": "5324280738ac779cb7538451c13804a0a984c3df89ed22a95c76684a81bb12f1",
"pubkey": "d5bf122d57bdad3b5e5112d094b3ead95f403eb5fc2feb1dbf0c50414eac357a",
"created_at": 1788432725,
"kind": 1,
"tags": [
[
"t",
"infosec"
],
[
"t",
"cybersecurity"
],
[
"proxy",
"https://defcon.social/users/thedarktangent/statuses/117206727106375189",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it . . .” Sounds like another race to update. \n\nhttps://github.com/MSNightmare/FalconFlank\n\n#InfoSec #cybersecurity",
"sig": "9df5c2a1d51e20e71a946c045fac7b71a18cb70c8d4fcafa711362b38f059d5415c8776409ff9f7c0b1fc4335dadf6d30e0a464f6e2a1c7acb3dba452a514770"
}