cbcvebase.
CVE-2024-30088
published 2024-06-11

CVE-2024-30088: Windows Kernel Elevation of Privilege Vulnerability

PriorityP187high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2024-11-05
Exploited in the wild
EPSS
68.20%
99.3th percentile
Windows Kernel Elevation of Privilege Vulnerability

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2068010.0.10240.20680
microsoftwindows_10_1607< 10.0.14393.707010.0.14393.7070
microsoftwindows_10_1809< 10.0.17763.593610.0.17763.5936
microsoftwindows_10_21h2< 10.0.19044.452910.0.19044.4529
microsoftwindows_10_22h2< 10.0.19045.452910.0.19045.4529
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2068010.0.10240.20680
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.707010.0.14393.7070
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.593610.0.17763.5936
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.593610.0.17763.5936
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.452910.0.19044.4529
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.452910.0.19045.4529
microsoftwindows_11_21h2< 10.0.22000.301910.0.22000.3019
microsoftwindows_11_22h2< 10.0.22621.373710.0.22621.3737
microsoftwindows_11_23h2< 10.0.22631.373710.0.22631.3737
microsoftwindows_11_version_21h2>= 10.0.22000.0 < 10.0.22000.301910.0.22000.3019
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.373710.0.22621.3737
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.373710.0.22631.3737
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.373710.0.22631.3737
microsoftwindows_server_2016< 10.0.14393.707010.0.14393.7070
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.707010.0.14393.7070
microsoftwindows_server_2019< 10.0.17763.593610.0.17763.5936
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.593610.0.17763.5936
microsoftwindows_server_2022< 10.0.20348.252210.0.20348.2522
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.252710.0.20348.2527
microsoftwindows_server_2022_23h2< 10.0.25398.95010.0.25398.950

Detection & IOCsextracted from sources · hover to see the quote

filenamepsgfilter.dll
pathC:\Windows\System32\psgfilter.dll
registryHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = scecli, psgfilter
  • Hunt for the PDB artifact string 'CVE-2024-30088-main' in memory or on disk, which indicates use of the public PoC-derived privilege escalation tool.
  • Monitor for 'psgfilter.dll' being written to C:\Windows\System32 and the LSA Notification Packages registry value being modified to include 'psgfilter', indicating malicious password filter DLL registration for credential harvesting.
  • Detect web shell activity by monitoring IIS/web server processes for HTTP requests containing both 'func' and 'command' header values, particularly 'func=Exc', which is used to execute PowerShell commands, upload, or download files.
  • Detect ngrok usage on servers/domain controllers as a lateral movement and tunneling indicator associated with this campaign.
  • ·The exploit binary (p.enc / decoded payload) is derived from a public open-source PoC project for CVE-2024-30088; defenders should expect variants with different filenames but the same PDB path pattern or XOR-encoded delivery via a loader.
  • ·The vulnerability works on multiple versions of Windows 10 and 11; patching scope should not be limited to a single OS version.

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.0HIGH
cisa7.0HIGH
vendor_msrc7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.