Bypass Record
Exploitation for Priv-Esc × Avast Antivirus
A publicly-reported instance of Exploitation for Priv-Esc bypassing Avast Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The exploit leverages a vulnerability in Avast Antivirus to gain SYSTEM privileges, enabling dumping of the SAM database for credential theft and spawning a SYSTEM shell. It defeats the security agent's protection by exploiting a flaw in the product itself.
Detection & mitigation
Monitor for unexpected privilege escalation or suspicious processes spawning with SYSTEM integrity, especially involving Avast processes. Ensure Avast is updated once a patch is released and consider application whitelisting to prevent execution of untrusted binaries.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.