CVE-2026-78413: Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.
The Windows.Sysinternals.SysmonLogForward is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECTCLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and run a different binary program than the installed sysmon binary. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECTCLIENT given typically by the "Investigator" role).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require EXECVE permission to launch the Windows.Sysinternals.SysmonLogForward artifact, limiting collection to users with that high-privilege permission.
Windows.Sysinternals.SysmonLogForward required permission = EXECVE
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must already be able to collect artifacts from the target endpoint using the COLLECT_CLIENT permission. This permission is typically assigned through the Investigator role.
What does an attacker need to do to trigger the escalation?
The attacker can collect the Windows.Sysinternals.SysmonLogForward monitoring artifact and provide an arbitrary binary path instead of the installed Sysmon binary. The artifact may then run that different program with elevated permissions.
Is this limited to Sysmon event forwarding deployments?
The affected component is the Windows.Sysinternals.SysmonLogForward client monitoring artifact. Exploitation depends on being able to invoke that artifact against an endpoint, rather than merely having Sysmon installed.