CVE-2018-8440 ALPC LPE PoC (SandboxEscaper, Task Scheduler)

Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.

2 syscalls cited

NtAlpcOpenSenderProcess
Server-side helper that opens a HANDLE to the process that sent a given ALPC message.
NtAlpcOpenSenderThread
Server-side helper that opens a HANDLE to the thread that sent a given ALPC message.