Ghostscript Spawned By IIS/PHP Process Via Imagick Delegate (CVE-2026-65640) - Windows - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects the Ghostscript binary (gswin32c.exe, gswin64c.exe or their non-console variants) spawned as a child of IIS, PHP-CGI or PHP runtime processes on Windows, consistent with ImageMagick's delegate mechanism processing a file that Imagick identified as PostScript content, the trigger condition for CVE-2026-65640. The attacker does not control which binary gets invoked, that is determined by the server's ImageMagick delegates.xml configuration, so this signal is not evadable by renaming an attacker-controlled implant the way a dropped webshell can be. Confirmation signal on a different surface than the web-layer rule, covering the Windows hosting gap not seen by the Linux process rule. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le binaire Ghostscript (gswin32c.exe, gswin64c.exe ou leurs variantes non console) lance en tant qu'enfant de processus IIS, php-cgi.exe ou php.exe sur Windows, cohérent avec le mecanisme de delegation d'ImageMagick traitant un fichier qu'Imagick a identifie comme du contenu PostScript, la condition declenchante de CVE-2026-65640. L'attaquant ne controle pas quel binaire est invoque, cela depend de la configuration delegates.xml d'ImageMagick sur le serveur : ce signal n'est donc pas evasible en renommant un implant controle par l'attaquant, contrairement a un webshell depose. Signal de confirmation sur une couche differente de la regle web, couvre l'angle mort des hebergements Windows non couvert par la regle Linux. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Ghostscript Spawned By IIS/PHP Process Via Imagick Delegate (CVE-2026-65640) - Windows - STRICT
id: 4bc5899c-59fa-4d9d-b32a-6447436078e7
status: experimental
description: |
Detects the Ghostscript binary (gswin32c.exe, gswin64c.exe or their non-console variants) spawned as a child of IIS, PHP-CGI or PHP runtime processes on Windows, consistent with ImageMagick's delegate mechanism processing a file that Imagick identified as PostScript content, the trigger condition for CVE-2026-65640. The attacker does not control which binary gets invoked, that is determined by the server's ImageMagick delegates.xml configuration, so this signal is not evadable by renaming an attacker-controlled implant the way a dropped webshell can be. Confirmation signal on a different surface than the web-layer rule, covering the Windows hosting gap not seen by the Linux process rule. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le binaire Ghostscript (gswin32c.exe, gswin64c.exe ou leurs variantes non console) lance en tant qu'enfant de processus IIS, php-cgi.exe ou php.exe sur Windows, cohérent avec le mecanisme de delegation d'ImageMagick traitant un fichier qu'Imagick a identifie comme du contenu PostScript, la condition declenchante de CVE-2026-65640. L'attaquant ne controle pas quel binaire est invoque, cela depend de la configuration delegates.xml d'ImageMagick sur le serveur : ce signal n'est donc pas evasible en renommant un implant controle par l'attaquant, contrairement a un webshell depose. Signal de confirmation sur une couche differente de la regle web, couvre l'angle mort des hebergements Windows non couvert par la regle Linux. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://www.cve.org/CVERecord?id=CVE-2026-65640
- https://nvd.nist.gov/vuln/detail/CVE-2026-65640
- https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
- https://www.securityweek.com/wordpress-7-0-4-patches-remote-code-execution-vulnerability/
- https://cybersecuritynews.com/wordpress-imagick-rce-vulnerability/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-14
related:
- id: ef153a8d-c9d6-472c-b9c3-78e9ef3cff12
type: derived
- id: 37dbb2fa-b95a-4322-bcc0-3c14fbc3e412
type: derived
- id: 94b4dcf3-8f11-4c2d-8132-40743026958a
type: derived
tags:
- attack.execution
- attack.t1190
- cve.2026-65640
logsource:
product: windows
category: process_creation
definition: >
Windows process creation telemetry from Sysmon Event ID 1, EDR, or Security 4688 with
command line capture. Required fields: Image, ParentImage, ParentCommandLine, CommandLine.
detection:
selection_web_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\php-cgi.exe'
- '\php.exe'
- '\httpd.exe'
- '\nginx.exe'
selection_php_parent_cmd:
ParentCommandLine|contains:
- 'php-cgi.exe'
- 'php.exe'
- 'wp-content'
- 'wp-admin'
- 'index.php'
selection_ghostscript_child:
Image|endswith:
- '\gswin32c.exe'
- '\gswin64c.exe'
- '\gswin32.exe'
- '\gswin64.exe'
condition: >
(selection_web_parent or selection_php_parent_cmd) and
selection_ghostscript_child
fields:
- Computer
- User
- Image
- CommandLine
- ParentImage
- ParentCommandLine
- CurrentDirectory
- ProcessId
- ParentProcessId
falsepositives:
- Sites that intentionally use Imagick with the Ghostscript delegate to process legitimate EPS, PDF or PostScript uploads. This cannot be distinguished from exploitation by command line alone, since the delegate invocation uses the same configured command template regardless of whether the input content is malicious or benign; if this workflow is expected in the environment, scope or suppress this rule at the SIEM level for the specific hosts running it, or consider disabling the Ghostscript delegate if the feature is not actually needed
- Manual administrative use of Ghostscript from a web-triggered maintenance script (rare, validate against known baselines)
level: critical