CrowdStrike urges customers to temporarily disable Office macros while investigating FalconFlank PoC

CrowdStrike said on September 8 it is investigating public claims around a privilege-escalation proof of concept called FalconFlank and advised customers to temporarily disable a specific Windows policy tied to Microsoft Office macro remediation. The company said the setting is the “Microsoft Office File Suspicious Macro Removal” Windows policy. CrowdStrike said customers remain protected through its “Cloud Anti-malware for Microsoft Office Files” settings while it reviews the issue. Reports published this week said the company also posted a FalconFlank Tech Alert and detection guidance in its customer support portal. ### What exactly did CrowdStrike tell customers to change? CrowdStrike told customers to disable the “Microsoft Office File Suspicious Macro Removal” Windows policy setting while it investigates the FalconFlank claims, according to statements reported by multiple security publications. The company said that protection remains in place through “Cloud Anti-malware for Microsoft Office Files” settings and directed customers to a FalconFlank Tech Alert in its support portal. (cybersecuritynews.com) The support-portal alert is not publicly accessible, according to Infosecurity Magazine, which said the portal requires a customer account. The same report said CrowdStrike had not yet been assigned a CVE for the issue. ### What is FalconFlank alleged to do? A GitHub repository published by a researcher using the handle MSNightmare describes FalconFlank as a “0day privilege escalation” affecting CrowdStrike Falcon Sensor. (cybersecuritynews.com) The repository says the technique abuses CrowdStrike’s Office malicious-macro remediation path and claims it can work on fully updated Windows 11 25H2 and Windows Server 2025 systems. Cyber Security News reported on September 3 that the project included source code, project files and a compiled x64 release directory. (infosecurity-magazine.com) The same report said the claim involved local privilege escalation, meaning an attacker with limited access could seek higher privileges on a machine. ### Who released the proof of concept? Infosecurity Magazine said the researcher used the online names “Nightmare Eclipse,” “Infinite Nightmare” and “MSNightmare.” SecurityWeek reported on September 8 that the same researcher had also released zero-day exploits targeting Avast and Nvidia products. (github.com) The GitHub repository for FalconFlank was published on September 3, according to Infosecurity Magazine. (cybersecuritynews.com) The README in that repository says CrowdStrike may already detect the proof of concept and that testing may require exclusions or changes to the DLL-loading technique, which indicates the release was framed as a proof of concept rather than a vendor-issued advisory. (infosecurity-magazine.com) ### Has the claim been independently verified? Infosecurity Magazine reported that security researcher Kevin Beaumont said FalconFlank works. Cyber Security News, in its September 3 report, said the claim had not been independently verified at the time of writing. The public reporting available on September 8 did not show CrowdStrike announcing a patch or a public CVE. (infosecurity-magazine.com) CrowdStrike’s confirmed public position, as quoted by security outlets, was that it is actively investigating the claims and recommending the temporary policy change. ### Where can customers find the technical guidance now? CrowdStrike said customers should consult the FalconFlank Tech Alert in the CrowdStrike support portal. (infosecurity-magazine.com) Infosecurity Magazine said the company had posted the alert there, and the reported statement said the portal contains the vendor’s guidance while the investigation continues. September 8 is the latest date attached to CrowdStrike’s reported investigation statement in the available coverage. (cybersecuritynews.com) The next concrete step named by the company is customer review of the FalconFlank Tech Alert and related indicators in the support portal while CrowdStrike continues its investigation. (infosecurity-magazine.com)