Privilege escalation via insecure archive directory handling

Privilege escalation in Microsoft Sysmon before 14.11 allows local users to gain SYSTEM privileges through crafted archive paths. The ClipboardChange RPC handler writes and deletes attacker-controlled strings under the archive directory without verifying that a low-privilege user did not create the directory or redirect it with a junction. Exploitation requires local low-privilege access and an archive directory not already secured by enabled archival events; the resulting SYSTEM-context file operations enable elevation.