CrowdStrike Falcon mitigation leaves macro cleanup gap
On September 3, CrowdStrike advised Falcon customers to disable a Windows policy setting after researcher Nightmare Eclipse published FalconFlank, a privilege-escalation proof of concept. The same disclosure wave included exploits targeting Avast and Nvidia. Gen Digital said it fixed an issue affecting a subset of its products, including Avast; CrowdStrike is still investigating its case.
FalconFlank abuses Falcon’s feature for removing suspicious Office macros: the security product’s cleanup action becomes the route to higher privileges. Disabling that feature blocks this exploit path, and CrowdStrike says cloud anti-malware for Office files remains active, but the specific macro-removal behavior is lost.
The disclosures follow Nightmare Eclipse’s Kaspersky exploit, extending the pattern across security vendors. For Falcon fleets that rely on macro removal, cloud scanning remains, but that cleanup path is absent while CrowdStrike investigates—leaving a gap in how suspicious macros are handled.