Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: windows

CVE-2026-110936: Siemens Software Center DLL Side-Loading Vulnerability Actively Exploited

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-110936 is an uncontrolled search path element vulnerability affecting Siemens Software Center. An authenticated local attacker can exploit this by placing a specially crafted DLL in a directory searched by the application, leading to arbitrary code execution. This vulnerability is actively being exploited in the wild, making immediate patching crucial for affected organizations.

Technical Analysis

The vulnerability, classified as CWE-427 (Uncontrolled Search Path Element), resides in how Siemens Software Center loads dynamic-link libraries. The application searches an uncontrolled path, allowing an attacker to introduce a malicious DLL. When the Siemens Software Center application is subsequently executed, it loads the attacker’s DLL instead of a legitimate one, resulting in arbitrary code execution with the privileges of the affected application.

  • Vulnerability Type: Uncontrolled Search Path Element (CWE-427)
  • Affected Products: Siemens Software Center, all versions prior to V4.0.9.8
  • Attack Vector: Local, authenticated attacker (AV:L, PR:H)
  • Impact: Arbitrary code execution (C:H, I:H, A:H)
  • CVSS 3.1 Score: 6.7 (Medium)
    • Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Detection

Defenders should focus on monitoring for unusual process execution patterns originating from the Siemens Software Center application, as well as suspicious file modifications in relevant directories.

  • Process Creation Monitoring: Look for SiemensSoftwareCenter.exe spawning unusual child processes, especially command shells (cmd.exe), scripting interpreters (powershell.exe, wscript.exe, cscript.exe), or other unexpected executables.
  • DLL Load Monitoring: Monitor for SiemensSoftwareCenter.exe loading DLLs from non-standard or user-writable directories (e.g., user profile directories, temporary folders) rather than system or application installation paths.
  • File System Monitoring: Detect creation or modification of new DLL files in directories that SiemensSoftwareCenter.exe is known to search, particularly if these files are written by processes other than legitimate installers or update mechanisms.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Siemens Software Center Spawning Shell

title: Siemens Software Center Spawning Shell
id: 9283740e-1a2b-4c3d-5e6f-789012345678
status: experimental
description: Detects suspicious child process creation by Siemens Software Center, indicative of arbitrary code execution via DLL side-loading (CVE-2026-110936).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\SiemensSoftwareCenter.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement robust access controls to limit the potential impact of this vulnerability.

  1. Patch Immediately: Update Siemens Software Center to version V4.0.9.8 or later. Refer to the official Siemens advisory for specific update instructions.
  2. Least Privilege: Ensure that users operating Siemens Software Center do so with the absolute minimum necessary privileges. This limits the impact of arbitrary code execution.
  3. Restrict Write Access: Implement strict file system permissions to prevent unauthorized users from writing files, especially DLLs, into directories within the application’s search path.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-110936
  • https://cert-portal.siemens.com/productcert/html/ssa-580366.html
  • https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936
  • https://ltna.com.au/cyber
  • https://socprime.com/blog/cve-2026-110936-analysis/

Indicators of Compromise

Type Value Description
SHA256 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 Hash of the malicious DLL file archive.dll (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
SHA256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a Hash of the malware bundle AllMyBasic.msi (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
IP Address 2.27.248.127 Distribution channel of the malware bundle AllMyBasic.msi (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
IP Address 96.62.218.59 Payload hosting / Command and control server (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
Domain wizardexpensive.com Payload hosting / Command and control domain (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)

MITRE ATT&CK

  • T1574.001 — DLL
  • T1059 — Command and Scripting Interpreter
  • T1053.005 — Scheduled Task
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1204.002 — Malicious File
  • T1566.002 — Spearphishing Link
  • T1082 — System Information Discovery
  • T1218.007 — Msiexec
  • T1140 — Deobfuscate/Decode Files or Information
  • T1083 — File and Directory Discovery
  • T1059.001 — PowerShell
  • T1547.001 — Registry Run Keys / Startup Folder
  • T1562.001 — Disable or Modify Tools
  • T1078 — Valid Accounts
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1218.010 — Regsvr32
  • T1518.001 — Security Software Discovery
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1574.002 — DLL Side-Loading
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,160 input / 1,322 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged actively exploited, cve, dll-side-loading, industrial software, medium, romulus, siemens, vulnerability, windowsLeave a comment

CVE-2026-96655: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96655 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server. It allows an attacker to force the server to make requests to arbitrary internal or external addresses. This flaw is critical as it is actively being exploited, often chained with other vulnerabilities, to deploy cryptominer malware such as XMRig on compromised servers.

Technical Analysis

  • Vulnerability: Server-Side Request Forgery (SSRF) (CWE-918).
  • Affected Product: Plex Media Server.
  • Affected Versions: Before 1.43.3.10861.
  • Attack Vector: An authenticated user can manipulate the /video/:/transcode/universal path parameter to specify arbitrary URLs for the server to request.
  • Prerequisites: Requires an authenticated user session.
  • Impact: Allows an attacker to scan internal networks, access internal services, or potentially bypass firewall rules. When chained with other vulnerabilities, it can lead to remote code execution and resource hijacking.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, which community intelligence suggests are used together for remote code execution and cryptominer deployment.
  • CVSS 3.1: 4.3 (MEDIUM) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Detection

  • Monitor Plex Media Server web access logs for requests to the /video/:/transcode/universal path containing unusual or internal IP addresses/domains (e.g., 127.0.0.1, localhost, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) in the URI.
  • Look for outbound network connections originating from the Plex Media Server process to unexpected external IP addresses or ports, especially those associated with cryptomining pools (e.g., 3333, 4444, 5555, 7777, 8080, 9000, 14444).
  • Detect suspicious process creation by the Plex Media Server.exe process, such as cmd.exe, powershell.exe, sh.exe, or known cryptominer executables (e.g., xmrig.exe).
  • Hunt for resource utilization spikes (CPU, network) on the Plex server that are not correlated with legitimate media transcoding or streaming activities, potentially indicating cryptominer execution.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server SSRF Attempt via Transcode Path

title: Plex Media Server SSRF Attempt via Transcode Path
id: 9029a12a-f9c7-43f1-801e-2a21b36a18d9
status: experimental
description: Detects attempts to exploit CVE-2026-96655 by requesting internal or suspicious external addresses via the '/video/:/transcode/universal' path parameter in Plex Media Server web logs.
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|contains: '/video/:/transcode/universal'
  selection_target:
    c-uri|contains:
      - '127.0.0.1'
      - 'localhost'
      - '192.168.'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: all of selection*
level: high

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 7e7f1b2c-3d4e-4f5a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects Plex Media Server.exe spawning known cryptominer executables or common shell interpreters, indicating potential post-exploitation activity after chaining vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith: '\\Plex Media Server.exe'
  selection_child:
    Image|endswith:
      - '\\xmrig.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\sh.exe'
  condition: all of selection*
level: critical

Mitigations

  1. Immediately update Plex Media Server to version 1.43.3.10861 or later to patch CVE-2026-96655 and related vulnerabilities.
  2. Implement network segmentation to restrict outbound connections from the Plex Media Server to only necessary services and destinations.
  3. Enforce strong authentication policies for all Plex users, including multi-factor authentication where possible.
  4. Regularly review Plex Media Server logs for suspicious activity and unexpected outbound connections.
  5. Consider placing Plex Media Server behind a reverse proxy or Web Application Firewall (WAF) to filter malicious requests.

References

  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96655
  • https://zmain.info/blog/plex2shell
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db XMRig cryptominer payload (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 Cryptominer payload (docker) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 Cryptominer payload ‘x’ (UPX packed) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 Cryptominer payload ‘x’ (UPX unpacked) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 Proxy payload ‘myawesomeproxy’ (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 176.65.139.228 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 217.60.194.116 Source IP for malicious file download (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 91.92.40.202 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain proxystream.st Domain related to proxy service traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
URL https://zmain.info/blog/plex2shell Vulnerability research blog detailing the chained exploit (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
malware_family XMRig Cryptominer malware deployed post-exploitation
malware_family myawesomeproxy Proxy malware deployed post-exploitation

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1090.003 — Multi-hop Proxy
  • T1496 — Resource Hijacking
  • T1059 — Command and Scripting Interpreter
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,111 input / 2,003 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cryptominer, exploitation, medium, plex, ssrf, vulnerability, windows, xmrigLeave a comment

CVE-2026-96654: Plex Media Server URI Scheme Neutralization Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

Plex Media Server is affected by CVE-2026-96654, a medium-severity vulnerability allowing attackers to manipulate URI schemes to call internal plugin functions. This flaw can be chained with other vulnerabilities to achieve remote code execution. Threat actors are actively exploiting this to deploy cryptomining malware, making immediate patching critical for affected organizations and users.

Technical Analysis

  • CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page.
  • Description: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne, allowing an attacker to call other plugins’ functions and supply their own parameters.
  • CVSS 3.1: 6.5 (Medium) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates network access, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.
  • Weakness: CWE-84 (Improper Neutralization of Input During Web Page Generation).
  • Affected Versions: Plex Media Server versions prior to 1.43.0.10861.
  • Attack Vector: Network-based, unauthenticated. Exploitation involves crafting malicious URI requests to the Plex Media Server.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, potentially escalating impact to remote code execution.
  • Observed Impact: Active exploitation has been observed, leading to the deployment of cryptominer malware (e.g., XMRig) and proxy software (myawesomeproxy).

Detection

  • Monitor Plex Media Server process (Plex Media Server.exe) for unusual child process creation (e.g., cmd.exe, powershell.exe, wscript.exe, cscript.exe, or known cryptominer executables like xmrig.exe or myawesomeproxy.exe).
  • Inspect web server access logs for Plex Media Server for requests containing searchOne with unusual or encoded parameters, especially those attempting to invoke internal plugin functions.
  • Look for outbound network connections from the Plex Media Server process to known cryptomining pools or unusual IP addresses/ports.
  • Scan for the presence of known cryptominer executables (xmrig.exe) or proxy software (myawesomeproxy.exe) in unexpected directories, particularly within the Plex installation path or temporary directories.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server Spawning Suspicious Child Process

title: Plex Media Server Spawning Suspicious Child Process
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes (e.g., cmd, powershell, cryptominers) spawned by Plex Media Server, indicating potential exploitation of CVE-2026-96654 or similar vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\Plex Media Server.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\xmrig.exe'
      - '\myawesomeproxy.exe'
  condition: selection
level: high

XMRig Cryptominer Process Creation

title: XMRig Cryptominer Process Creation
id: 1f2e3d4c-5b6a-7f8e-9d0c-1b2a3f4e5d6c
status: experimental
description: Detects the creation of the XMRig cryptominer process, often deployed after successful exploitation of vulnerabilities like CVE-2026-96654.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\xmrig.exe'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes.
  2. Network Segmentation: Isolate Plex Media Server instances from critical internal networks.
  3. Restrict Outbound Connectivity: Implement firewall rules to limit outbound connections from the Plex Media Server to only necessary services, blocking access to known cryptomining pools.
  4. Principle of Least Privilege: Ensure the Plex Media Server runs with the minimum necessary user permissions.
  5. Regular Audits: Periodically review Plex Media Server logs and system activity for signs of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-96654
  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96654
  • https://zmain.info/blog/plex2shell
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db SHA256 hash of XMRig cryptominer (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 SHA256 hash of cryptominer docker file (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 SHA256 hash of UPX packed cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 SHA256 hash of UPX unpacked cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 SHA256 hash of ‘myawesomeproxy’ malware (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 176.65.139.228 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 217.60.194.116 Source IP for malicious file download (cryptominer) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP for initial exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 91.92.40.202 Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain proxystream.st Domain associated with ‘myawesomeproxy’ malware traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain sslip.io DNS service leveraged by attacker for owner token theft (via https://zmain.info/blog/plex2shell)
Email security@plex.tv Plex security contact email for vulnerability reporting (via https://zmain.info/blog/plex2shell)

MITRE ATT&CK

  • T1059.003 — Windows Command Shell
  • T1059.001 — PowerShell
  • T1496 — Resource Hijacking
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1190 — Exploit Public-Facing Application
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,105 input / 1,684 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cryptominer, exploitation, medium, plex, remote code execution, vulnerability, windowsLeave a comment

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-96951 is a high-severity command injection vulnerability affecting Microsoft Windows Shell. This flaw allows an unauthorized attacker to bypass security features over a network, with successful exploitation requiring user interaction. Its inclusion in CISA’s KEV catalog highlights its critical importance for immediate attention due to potential high impact on system confidentiality, integrity, and availability.

Technical Analysis

CVE-2026-96951 is an improper neutralization of special elements vulnerability (CWE-77) within Microsoft Windows Shell. This command injection flaw allows an unauthorized attacker to bypass security features. The attack vector is network-based (AV:N), and successful exploitation requires user interaction (UI:R) according to the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Specific affected Windows versions are not detailed in the provided information.

Detection

Detecting exploitation of CVE-2026-96951 involves monitoring for anomalous process execution and command line activity originating from Windows Shell components.

  • Monitor cmd.exe, powershell.exe, or other scripting interpreters being spawned as child processes of explorer.exe or other legitimate shell processes with unusual or encoded command-line arguments.
  • Look for command lines containing shell metacharacters (e.g., &, |, ;, &&, ||, (, )) that indicate an attempt to inject arbitrary commands.
  • Analyze process creation events (e.g., Sysmon Event ID 1) for processes launched with elevated privileges or from unexpected locations following shell interactions.
  • Review network logs for suspicious outbound connections initiated by shell processes that might indicate post-exploitation activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Interpreter Spawn from Explorer

title: Suspicious Interpreter Spawn from Explorer
id: 2b1a2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious command interpreter processes spawned directly by explorer.exe, which could indicate command injection exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
level: high

Command Line Injection Metacharacters

title: Command Line Injection Metacharacters
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects command lines containing common shell metacharacters often used in command injection attacks. This rule may be noisy and require tuning.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' & '
      - ' | '
      - ' ; '
      - ' && '
      - ' || '
      - '`' # Backtick for PowerShell
      - '$( ' # PowerShell subexpression
      - '`n' # Newline for PowerShell
  condition: selection
level: medium

Mitigations

  1. Apply the security update for CVE-2026-96951 from Microsoft as soon as it becomes available.
  2. Implement principle of least privilege for users and services to limit the impact of successful exploitation.
  3. Restrict network access to systems running Windows Shell components from untrusted networks where possible.
  4. Educate users on identifying and avoiding suspicious links or files, especially if user interaction is a prerequisite for exploitation.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-96951
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1059.003 — Windows Command Shell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,688 input / 1,282 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged command-injection, cve, high, vulnerability, windowsLeave a comment

Rejetto HFS Servers Actively Scanned for Critical RCE Flaw (CVE-2026-61500)

Posted on October 5, 2026 by Kyle

Overview

Rejetto HFS servers are currently being targeted by threat actors actively scanning for CVE-2026-61500, a critical vulnerability enabling Remote Code Execution (RCE). This flaw poses a significant risk due to its potential for complete system compromise, session hijacking, and account takeover. Organizations utilizing Rejetto HFS should prioritize assessment and mitigation efforts immediately.

Technical Analysis

The vulnerability, tracked as CVE-2026-61500, is described as a weak signing key issue within Rejetto HFS. This weakness can be exploited to perform session forgery, allowing attackers to hijack legitimate user sessions. More critically, it facilitates account takeover and ultimately leads to Remote Code Execution (RCE) on the underlying server. The specific versions of Rejetto HFS affected are not detailed in the provided source, but the vulnerability is actively being scanned for, indicating widespread potential impact. The attack vector is likely through crafted HTTP requests leveraging the weak signing key mechanism.

Detection

  • Process Creation Anomalies: Monitor for unusual child processes spawned by the hfs.exe process, such as cmd.exe, powershell.exe, sh.exe, or other scripting interpreters, especially with unusual command-line arguments.
  • Web Server Logs: Review HFS access logs for suspicious request patterns, including unusual HTTP methods, large or malformed parameters, or attempts to access administrative endpoints with forged session tokens. Look for unexpected POST requests to sensitive paths.
  • Network Traffic Analysis: Monitor network traffic originating from the HFS server for outbound connections to unknown or suspicious IP addresses, which could indicate post-exploitation activity like C2 communication or data exfiltration.
  • File System Changes: Look for unexpected file creations or modifications in the HFS web root or system directories, potentially indicating webshell deployment or other persistence mechanisms.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Rejetto HFS – Suspicious Child Process from hfs.exe

title: Rejetto HFS - Suspicious Child Process from hfs.exe
id: 9a3e4f1b-5c6d-4e7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects suspicious process creation by the Rejetto HFS server process, indicative of RCE exploitation (CVE-2026-61500).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\hfs.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\bitsadmin.exe'
      - '\\certutil.exe'
  condition: selection
level: high

Rejetto HFS – Unusual Outbound Network Connection from hfs.exe

title: Rejetto HFS - Unusual Outbound Network Connection from hfs.exe
id: 6c7d8e9f-0a1b-2c3d-4e5f-6a7b8c9d0e1f
status: experimental
description: Detects outbound network connections initiated by the Rejetto HFS process, which could indicate post-exploitation C2 or data exfiltration after RCE (CVE-2026-61500).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image|endswith: '\\hfs.exe'
    Initiated: 'true'
    DestinationIp|!startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '127.'
  condition: selection
level: medium

Mitigations

  1. Patch or Upgrade: Apply any available patches or upgrade to a non-vulnerable version of Rejetto HFS as soon as they are released by the vendor. (No specific patch information is available at the time of writing).
  2. Restrict Network Access: Limit network access to Rejetto HFS servers from untrusted networks. If possible, place HFS behind a firewall or reverse proxy and restrict access to only necessary IP ranges or internal networks.
  3. Disable Unnecessary Services: If Rejetto HFS is not critical for business operations, consider disabling or uninstalling it until a patch is available.
  4. Implement Web Application Firewall (WAF): Deploy a WAF in front of HFS to detect and block malicious web requests targeting the vulnerability.
  5. Principle of Least Privilege: Ensure the HFS service runs with the minimum necessary privileges to limit the impact of a successful exploit.

References

  • https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,512 input / 1,623 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged critical, hfs, rce, rejetto, vulnerability, webserver, windowsLeave a comment

University of Illinois Chicago College of Medicine Ransomware Incident

Posted on October 5, 2026 by Kyle

Overview

A ransomware attack has impacted the University of Illinois Chicago (UIC) College of Medicine, leading to the unauthorized access and theft of information from its servers. This incident highlights the critical risk ransomware presents to organizations holding sensitive data, particularly within the education and healthcare sectors, where data exfiltration often precedes encryption.

Technical Analysis

The provided source confirms a ransomware attack affected the UIC College of Medicine, resulting in data theft. Specific details regarding the initial access vector, the ransomware variant deployed, or the technical execution chain are not publicly available at the time of writing. Ransomware operations typically involve initial compromise (e.g., phishing, exploiting vulnerabilities), lateral movement, privilege escalation, data exfiltration, and finally, encryption of systems.

Detection

Given the lack of specific indicators for this incident, detection efforts should focus on general ransomware behaviors:
* Shadow Copy Deletion: Monitoring for vssadmin.exe or wmic.exe commands used to delete shadow copies, often a precursor to encryption.
* Mass File Renames/Encryption: Detecting a high volume of file rename operations or the creation of files with known ransomware extensions (e.g., .locked, .enc, .crypt).
* Suspicious Process Activity: Identifying unusual process trees, such as cmd.exe or powershell.exe being spawned by non-standard parent processes (e.g., a web server, database service) to execute system commands.
* Network Traffic Anomalies: Monitoring for large outbound data transfers indicative of data exfiltration to unknown or suspicious IP addresses.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Shadow Copy Deletion via Vssadmin

title: Suspicious Shadow Copy Deletion via Vssadmin
id: 93f7e1b2-c8d3-4a1e-b0a6-f2d1e2a8c3d7
status: experimental
description: Detects attempts to delete shadow copies using vssadmin.exe, a common ransomware tactic.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
level: high

Suspicious Shadow Copy Deletion via WMIC

title: Suspicious Shadow Copy Deletion via WMIC
id: 7e1b2c8d-3a4e-b0a6-f2d1e2a8c3d8
status: experimental
description: Detects attempts to delete shadow copies using wmic.exe, another common ransomware tactic.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: selection
level: high

Unusual Process Spawning System Commands

title: Unusual Process Spawning System Commands
id: 1b2c8d3a-4eb0-a6f2-d1e2a8c3d9e0
status: experimental
description: Identifies suspicious process creations where non-standard parent processes spawn cmd.exe or powershell.exe to execute system commands, potentially indicative of compromise or ransomware activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Program Files\\Microsoft SQL Server\\'
      - '\\Apache24\\bin\\httpd.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: selection
level: medium

Mitigations

  1. Maintain Regular Backups: Implement a robust backup strategy following the 3-2-1 rule, ensuring backups are immutable and stored offline or off-site.
  2. Patch and Update Systems: Regularly apply security patches and updates to operating systems, applications, and network devices to remediate known vulnerabilities.
  3. Implement Network Segmentation: Segment networks to limit lateral movement and contain potential breaches, isolating critical systems and sensitive data.
  4. Deploy Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious activities, detect ransomware behaviors, and enable rapid response.
  5. Enforce Principle of Least Privilege: Restrict user and service accounts to the minimum necessary permissions required for their functions.
  6. Conduct Security Awareness Training: Educate users on identifying and reporting phishing attempts and other social engineering tactics.

References

  • https://therecord.media/ransomware-university-illinois-chicago

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1486 — Data Encrypted for Impact
  • T1070.004 — File Deletion
  • T1560.001 — Archive via Utility
  • T1059.003 — Windows Command Shell
  • T1059.001 — PowerShell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,463 input / 1,362 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in ransomwareTagged data-theft, education, healthcare, high, ransomware, windowsLeave a comment

Phishing Abuses RMM Tools for Persistent Access

Posted on September 30, 2026 by Kyle

Overview

This report details recent phishing campaigns observed by Microsoft that exploit legitimate Remote Monitoring and Management (RMM) tools. Attackers are using MSP360 RMM to deploy ScreenConnect, creating redundant and persistent remote access channels. This strategy allows threat actors to maintain control over compromised environments for follow-on activities, posing a significant risk to organizations utilizing or exposed to these tools.

Technical Analysis

  • Initial Access: Phishing campaigns serve as the initial vector, compromising user credentials or tricking users into executing malicious payloads.
  • Tool Deployment: Upon successful initial compromise, attackers deploy MSP360 RMM (formerly CloudBerry Remote Assistant) to gain initial remote control.
  • Redundant Access: MSP360 RMM is then leveraged to deploy ScreenConnect (ConnectWise Control), establishing a secondary, persistent remote access channel.
  • Purpose: This creates multiple avenues for remote control and persistence, enhancing attacker resilience against detection or remediation efforts and facilitating long-term access.
  • Affected Tools: MSP360 RMM, ScreenConnect (ConnectWise Control).

Detection

  • Monitor for the installation of legitimate RMM software (e.g., ScreenConnect.exe, cbsa.exe for MSP360 RMM) on endpoints where it is not explicitly authorized or expected by IT administration.
  • Look for suspicious process parent-child relationships, such as powershell.exe or cmd.exe spawning RMM installer executables or their agents.
  • Analyze network traffic for connections from RMM tool processes to unexpected or unapproved external IP addresses or domains.
  • Review endpoint logs for unusual service creations or modifications related to RMM tools, especially those configured for automatic startup.
  • Hunt for ScreenConnect.exe or cbsa.exe processes running on non-IT administration workstations or servers.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious RMM Agent Process Creation

title: Suspicious RMM Agent Process Creation
id: 4d1e2f3a-5b6c-4d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects the creation of processes associated with legitimate RMM tools (ScreenConnect, MSP360 RMM) that could be abused by attackers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith:
      - '\ScreenConnect.exe'
      - '\cbsa.exe'
  condition: selection
level: high

RMM Tool Initiating Network Connection

title: RMM Tool Initiating Network Connection
id: 7e8f9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b
status: experimental
description: Detects network connections initiated by ScreenConnect or MSP360 RMM agents, which could indicate active remote control or data exfiltration.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\ScreenConnect.exe'
      - '\cbsa.exe'
  condition: selection
level: medium

Mitigations

  1. User Awareness Training: Educate users on identifying and reporting phishing attempts, especially those involving social engineering tactics to install software or grant remote access.
  2. Multi-Factor Authentication (MFA): Implement MFA for all remote access services, critical accounts, and RMM tool access to prevent unauthorized access even if credentials are stolen.
  3. Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious process execution, file modifications, and network connections indicative of RMM tool abuse.
  4. Application Whitelisting/Control: Restrict the execution of unauthorized applications, including RMM tools, to only approved software and specific user groups.
  5. Network Segmentation: Isolate critical systems and segment networks to limit lateral movement and the scope of compromise if an endpoint is breached.
  6. Monitor RMM Tool Usage: Strictly monitor and audit the legitimate use of RMM tools, ensuring they are only deployed and accessed by authorized personnel from approved locations and for documented purposes.

References

  • https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1566.001 — Spearphishing Attachment
  • T1219 — Remote Access Tools
  • T1133 — External Remote Services
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,587 input / 1,277 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in phishingTagged high, msp360, persistence, phishing, rmm, screenconnect, windowsLeave a comment

NeedyMantis: Modular Post-Compromise Malware Framework

Posted on September 28, 2026 by Kyle

Overview

NeedyMantis is a modular post-compromise malware framework used in targeted intrusions. It leverages custom loaders, encrypted archives, and extensible components to establish and maintain long-term access, enabling subsequent malicious operations. Microsoft Threat Intelligence identified this framework in use against specific targets.

Technical Analysis

  • NeedyMantis operates as a modular framework, allowing threat actors to deploy various components as needed.
  • It utilizes custom loaders, suggesting a tailored approach to initial execution and evasion.
  • The framework employs encrypted archives, likely for storing its components, exfiltrating data, or obscuring malicious payloads.
  • Designed for extensibility, indicating a capability for threat actors to adapt and expand its functionalities post-compromise.
  • The primary objective is to maintain long-term access within compromised environments and support follow-on activities.

Detection

  • Monitor for suspicious process creation chains, particularly legitimate processes (e.g., svchost.exe, explorer.exe) spawning unusual executables in non-standard paths.
  • Look for the creation or modification of encrypted archive files (e.g., .zip, .rar, .7z) in unexpected directories, especially by processes not typically associated with archiving.
  • Analyze network traffic for unusual outbound connections to unknown or suspicious IP addresses and domains, indicative of command-and-control (C2) communication.
  • Hunt for registry modifications or scheduled tasks establishing persistence, especially those pointing to newly created or modified executables.
  • Monitor for unusual file system activity, such as the creation of hidden files or directories, or modifications to system binaries.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Process Spawning from Legitimate Parent

title: Suspicious Process Spawning from Legitimate Parent
id: 9c1d2e3f-4a5b-6c7d-8e9f-0123456789ab
status: experimental
description: Detects suspicious process creation where a common legitimate Windows process spawns an unusual executable in a non-standard path, indicative of a custom loader or malware execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\svchost.exe'
      - '\\explorer.exe'
      - '\\lsass.exe'
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - ' -load'
      - ' -exec'
  condition: selection
level: high

Creation of Encrypted Archive in Suspicious Location

title: Creation of Encrypted Archive in Suspicious Location
id: a1b2c3d4-e5f6-7a8b-9c0d-1234567890ef
status: experimental
description: Detects the creation of common encrypted archive file types in user profile or system temporary directories, which could indicate data staging for exfiltration or malware component storage.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11 # FileCreate
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.gz'
      - '.tar.gz'
    TargetFilename|contains:
      - 'C:\Users\'
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\'
  condition: selection
level: medium

Registry Persistence via Run Key for Suspicious Path

title: Registry Persistence via Run Key for Suspicious Path
id: b2c3d4e5-f6a7-8b9c-0d1e-2345678901fg
status: experimental
description: Identifies modifications to common Windows Run registry keys that point to executables in non-standard or temporary directories, a common persistence mechanism for malware like NeedyMantis.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 13 # RegistryEvent (Value Set)
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Run\'
      - 'Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    Details|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
      - '.exe'
      - '.dll'
  condition: selection
level: high

Mitigations

  1. Implement robust Endpoint Detection and Response (EDR) solutions to detect and respond to post-compromise activities, including suspicious process execution and file modifications.
  2. Enforce application whitelisting or strong application control policies to prevent the execution of unauthorized or unknown executables and scripts, including custom loaders.
  3. Regularly patch and update all operating systems, applications, and network devices to remediate known vulnerabilities that could be exploited for initial access.
  4. Implement network segmentation and egress filtering to limit lateral movement and restrict outbound connections to only necessary and approved destinations.
  5. Conduct regular security audits and penetration testing to identify and address weaknesses in your environment before they can be exploited.

References

  • https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1055 — Process Injection
  • T1071.001 — Web Protocols
  • T1560.001 — Archive via Utility
  • T1105 — Ingress Tool Transfer
  • T1547.001 — Registry Run Keys / Startup Folder
  • T1090 — Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,611 input / 1,597 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in malwareTagged high, malware, persistence, post-compromise, targeted-attack, windowsLeave a comment

Storm-2570 Ransomware Affiliate Tradecraft Analysis

Posted on September 28, 2026 by Kyle

Overview

Storm-2570 is a ransomware affiliate group that consistently employs similar post-compromise tools and techniques across various ransomware deployments. This group has been observed deploying Qilin, DragonForce, Anubis, and BERT ransomware families. Understanding their consistent tradecraft is crucial for defenders to detect and disrupt their activities before the final ransomware payload is executed.

Technical Analysis

Storm-2570 operates as a ransomware affiliate, indicating they likely gain initial access and establish persistence before deploying one of several ransomware families. Their operations are characterized by consistent post-compromise tradecraft, suggesting a standardized playbook for internal network reconnaissance, privilege escalation, lateral movement, and data exfiltration, culminating in ransomware deployment.
* Ransomware Families Observed: Qilin, DragonForce, Anubis, BERT.
* Attack Vector: Not specified in the provided source, but typically involves initial access methods like phishing, exploiting public-facing applications, or compromised credentials.
* Prerequisites: Successful initial compromise and establishment of a foothold within the target environment.

Detection

Detection efforts should focus on the consistent post-compromise activities that precede ransomware deployment. While specific tools are not detailed in the provided source, common ransomware affiliate behaviors include:
* Suspicious process creation by services or system accounts (e.g., cmd.exe, powershell.exe).
* Execution of legitimate administrative tools for malicious purposes (e.g., PsExec, net.exe, wmic.exe).
* Deletion of shadow copies using vssadmin.exe.
* Attempts to disable security software.
* Abnormal network connections for data exfiltration or command and control.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Ransomware – Shadow Copy Deletion via Vssadmin

title: Ransomware - Shadow Copy Deletion via Vssadmin
id: 9a0b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects attempts to delete shadow copies using vssadmin.exe, a common precursor to ransomware encryption.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
level: high

Suspicious Process Creation by Services

title: Suspicious Process Creation by Services
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects common command-line interpreters or administrative tools spawned by services, which can indicate post-compromise activity by ransomware affiliates.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith:
      - '\\services.exe'
      - '\\svchost.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wmic.exe'
      - '\\mshta.exe'
      - '\\regsvr32.exe'
  condition: selection
level: medium

Mitigations

  1. Implement strong access controls and least privilege: Limit user and service account permissions to only what is necessary.
  2. Patch and update systems regularly: Prioritize patching internet-facing applications and systems.
  3. Deploy endpoint detection and response (EDR) solutions: Monitor for suspicious process activity, file modifications, and network connections.
  4. Regularly back up critical data: Ensure backups are isolated and immutable to prevent ransomware encryption.
  5. Educate users on phishing and social engineering: Reduce the risk of initial access via user compromise.

References

  • Microsoft Security Blog: Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1059 — Command and Scripting Interpreter
  • T1082 — System Information Discovery
  • T1018 — Remote System Discovery
  • T1021 — Remote Services
  • T1490 — Inhibit System Recovery
  • T1486 — Data Encrypted for Impact
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,609 input / 1,235 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in ransomwareTagged high, ransomware, storm-2570, threat-group, windowsLeave a comment

CVE-2026-50522: Critical SharePoint RCE via Deserialization of Untrusted Data

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-50522 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability is actively exploited in the wild, posing a significant risk of full SharePoint compromise and potential lateral movement, including machine key theft.

Technical Analysis

The vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists within Microsoft SharePoint Server. An attacker can exploit this flaw by sending specially crafted network requests that, when deserialized by the SharePoint application, lead to arbitrary code execution.

  • Vulnerability Type: Deserialization of Untrusted Data (CWE-502).
  • Affected Products:
    • microsoft sharepoint_server versions prior to 16.0.19725.20434
    • microsoft sharepoint_server 2016
    • microsoft sharepoint_server 2019
  • CVSS v3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector: Network (AV:N). No authentication or user interaction is required (PR:N, UI:N).
  • Impact: Complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H) due to remote code execution.
  • Exploitation: Publicly reported exploitation includes the theft of SharePoint machine keys, which can lead to further compromise of the SharePoint farm. The ViewState malware family is linked to exploitation.

Detection

Detection efforts should focus on identifying post-exploitation activity and suspicious network requests targeting SharePoint servers.

  • Process Creation Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe). Look for cmd.exe, powershell.exe, pwsh.exe, mshta.exe, cscript.exe, wscript.exe, or other scripting/system utilities.
  • Web Server Logs: Analyze IIS/web server logs for SharePoint for unusual POST requests, particularly those with large payloads, suspicious user agents, or requests to uncommon application pages.
  • File System Monitoring: Monitor for new or modified files in SharePoint web directories (_layouts, _vti_bin, wpresources) that could indicate webshell deployment or other persistence mechanisms.
  • Network Traffic Analysis: Look for unusual outbound connections from SharePoint servers to external IPs, especially after suspicious inbound requests.
  • Registry/File Access: Monitor for access to SharePoint configuration files (web.config) or registry keys related to machine keys, as this has been observed in active exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

SharePoint IIS Worker Suspicious Child Process

title: SharePoint IIS Worker Suspicious Child Process
id: d7e0f8b1-c9a3-4e6d-b2f5-a1c8e7d4f0a9
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by an IIS worker process (w3wp.exe), which is a common indicator of RCE on SharePoint servers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

SharePoint Timer Service Suspicious Child Process

title: SharePoint Timer Service Suspicious Child Process
id: e9c2d1a0-f3b4-4c5d-a6e7-b8f9c0d1e2f3
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by the SharePoint Timer Service (owstimer.exe), which can also be exploited for RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\owstimer.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

Mitigations

  1. Patch Immediately: Apply the latest security updates from Microsoft for SharePoint Server. Specifically, update to 16.0.19725.20434 or later for affected versions. Refer to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-50522.
  2. Network Segmentation: Isolate SharePoint servers from untrusted networks and segment them from other critical internal systems.
  3. Least Privilege: Ensure SharePoint service accounts and application pools run with the minimum necessary privileges.
  4. Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious web requests, though specific deserialization payloads may be difficult to block without specific signatures.
  5. Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in case of compromise.

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
  • https://nvd.nist.gov/vuln/detail/CVE-2026-50522
  • https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
  • https://www.resecurity.com/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks
  • https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
  • T1552.004 — Private Keys
  • T1505.003 — Web Shell
  • T1036 — Masquerading
  • T1530 — Data from Cloud Storage
  • T1213 — Data from Information Repositories
  • T1059.001 — PowerShell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,289 input / 1,875 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged active-exploitation, critical, cve-2026-50522, deserialization, kev-adjacent, machine-key-th, microsoft, on-prem, patch-tuesday, rce, sharepoint, vulnerability, windowsLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.