LevelBlue Details YellowKey BitLocker Bypass and Windows Privilege-Escalation Techniques

Article Details

Attack Vectors

• YellowKey uses brief physical access and a USB device, or staging on the EFI System Partition, to place crafted TxF/CLFS data where WinRE can process it during early boot.
• YellowKey exploits WinRE transaction replay to overwrite winpeshl.ini, causing the recovery shell to fall back to cmd.exe after the TPM has unlocked a BitLocker volume. The report identifies TPM-only configurations as vulnerable; Microsoft says TPM+PIN configurations are not vulnerable.
• MiniPlasma exploits a race condition in cldflt.sys by interrupting Cloud Files hydration with CfAbortOperation while changing thread impersonation state, enabling registry access-check bypass and local privilege escalation to SYSTEM.
• MiniPlasma redirects a registry path and the windir environment variable, then uses the Windows Error Reporting QueueReporting scheduled task to run an attacker-controlled wermgr.exe under SYSTEM.
• GreenPlasma uses Windows object manager symbolic links and CTF-related namespaces to create an attacker-controlled section object in a protected location.

Defensive Notes

• Microsoft's guidance for CVE-2026-45585 is to remove autofstx.exe from the BootExecute registry value in the WinRE image; the article says a security update was pending.
• Microsoft confirms that TPM+PIN configurations are not vulnerable to YellowKey. The disclosure actor's contrary claim about TPM+PIN is unsupported by a released PoC and conflicts with Microsoft's guidance.
• Restrict external boot and protect UEFI/BIOS settings to reduce USB-based staging risk. The article notes these controls do not fully prevent offline modification of the EFI System Partition.
• Correlate TxF/CLFS filesystem artifacts, WinRE entry and duration, BootExecute contents in the WinRE offline SYSTEM hive, and recovery-session behavior. The report identifies VMware OUI values in TxF GUIDs as a high-confidence forensic marker on physical endpoints, but says the marker is not guaranteed across variants.
• Monitor for MiniPlasma-related registry symbolic links and windir changes, unexpected QueueReporting task execution, wermgr.exe launched from a non-standard path, and the MiniPlasmaWERPipe named pipe.
• The article recommends auditing CloudFiles policy-key and Volatile Environment registry changes, and considering restrictions on manual triggering of Windows Error Reporting scheduled tasks where not operationally required.