UnCanny exposes NTLM coercion via Windows Store InstallService for local privilege escalation
The UnCanny GitHub proof‑of‑concept shows a new LPE primitive where a standard user supplies a UNC path in the Windows Store InstallService’s plugin JSON, causing the system service (InstallService.exe) to load the path and issue outbound NTLM as the machine account. This reveals a machine‑account NTLM coercion vector that can be leveraged for privilege escalation on unpatched Windows machines.