Ghostscript DLL Loaded Into IIS/PHP Process Via Imagick Delegate (CVE-2026-65640) - Windows - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects gsdll32.dll or gsdll64.dll (the Ghostscript DLL interface) being loaded into an IIS, PHP-CGI or PHP runtime process on Windows. On Windows, ImageMagick's Ghostscript delegate can be configured to use this DLL interface, executing PostScript content in-process via a loaded module rather than spawning a separate gswin32c.exe/gswin64c.exe child process. This is a structural blind spot for windows_ghostscript_spawn_via_imagick_delegate_cve_2026_65640_strict.yml, which depends entirely on a new process_creation event and cannot see this in-process execution path at all. This rule covers a genuinely different telemetry layer (module/image load, Sysmon Event ID 7) rather than process creation. No equivalent gap exists on Linux, where ImageMagick's Ghostscript delegate is always invoked as a separate external process. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le chargement de gsdll32.dll ou gsdll64.dll (l'interface DLL de Ghostscript) dans un processus IIS, php-cgi.exe ou php.exe sur Windows. Sous Windows, le delegue Ghostscript d'ImageMagick peut etre configure pour utiliser cette interface DLL, executant le contenu PostScript en memoire via un module charge plutot qu'en lancant un processus enfant separe gswin32c.exe/gswin64c.exe. C'est un angle mort structurel pour windows_ghostscript_spawn_via_imagick_delegate_cve_2026_65640_strict.yml, qui depend entierement d'un nouvel evenement process_creation et ne peut absolument pas voir ce chemin d'execution en memoire. Cette regle couvre une couche de telemetrie veritablement differente (chargement de module, Sysmon Event ID 7) plutot que la creation de processus. Aucun angle mort equivalent n'existe sous Linux, ou le delegue Ghostscript d'ImageMagick est toujours invoque comme un processus externe separe. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Ghostscript DLL Loaded Into IIS/PHP Process Via Imagick Delegate (CVE-2026-65640) - Windows - STRICT
id: 94b4dcf3-8f11-4c2d-8132-40743026958a
status: experimental
description: |
Detects gsdll32.dll or gsdll64.dll (the Ghostscript DLL interface) being loaded into an IIS, PHP-CGI or PHP runtime process on Windows. On Windows, ImageMagick's Ghostscript delegate can be configured to use this DLL interface, executing PostScript content in-process via a loaded module rather than spawning a separate gswin32c.exe/gswin64c.exe child process. This is a structural blind spot for windows_ghostscript_spawn_via_imagick_delegate_cve_2026_65640_strict.yml, which depends entirely on a new process_creation event and cannot see this in-process execution path at all. This rule covers a genuinely different telemetry layer (module/image load, Sysmon Event ID 7) rather than process creation. No equivalent gap exists on Linux, where ImageMagick's Ghostscript delegate is always invoked as a separate external process. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le chargement de gsdll32.dll ou gsdll64.dll (l'interface DLL de Ghostscript) dans un processus IIS, php-cgi.exe ou php.exe sur Windows. Sous Windows, le delegue Ghostscript d'ImageMagick peut etre configure pour utiliser cette interface DLL, executant le contenu PostScript en memoire via un module charge plutot qu'en lancant un processus enfant separe gswin32c.exe/gswin64c.exe. C'est un angle mort structurel pour windows_ghostscript_spawn_via_imagick_delegate_cve_2026_65640_strict.yml, qui depend entierement d'un nouvel evenement process_creation et ne peut absolument pas voir ce chemin d'execution en memoire. Cette regle couvre une couche de telemetrie veritablement differente (chargement de module, Sysmon Event ID 7) plutot que la creation de processus. Aucun angle mort equivalent n'existe sous Linux, ou le delegue Ghostscript d'ImageMagick est toujours invoque comme un processus externe separe. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://www.cve.org/CVERecord?id=CVE-2026-65640
- https://nvd.nist.gov/vuln/detail/CVE-2026-65640
- https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
- https://www.securityweek.com/wordpress-7-0-4-patches-remote-code-execution-vulnerability/
- https://cybersecuritynews.com/wordpress-imagick-rce-vulnerability/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-14
related:
- id: ef153a8d-c9d6-472c-b9c3-78e9ef3cff12
type: derived
- id: 37dbb2fa-b95a-4322-bcc0-3c14fbc3e412
type: derived
- id: 4bc5899c-59fa-4d9d-b32a-6447436078e7
type: derived
tags:
- attack.execution
- attack.t1190
- cve.2026-65640
logsource:
product: windows
category: image_load
definition: >
Windows module/DLL load telemetry from Sysmon Event ID 7 or EDR. Required fields: Image,
ImageLoaded. Sysmon Event ID 7 (image load) is not enabled by default in a stock Sysmon
configuration due to volume; verify this event class is collected before relying on this
rule.
detection:
selection_web_process:
Image|endswith:
- '\w3wp.exe'
- '\php-cgi.exe'
- '\php.exe'
selection_ghostscript_dll:
ImageLoaded|endswith:
- '\gsdll32.dll'
- '\gsdll64.dll'
condition: selection_web_process and selection_ghostscript_dll
fields:
- Computer
- User
- Image
- ImageLoaded
- ProcessId
falsepositives:
- Sites that intentionally use Imagick with the Ghostscript DLL delegate to process legitimate EPS, PDF or PostScript uploads, same non-filterable false positive as the sibling process-creation rules, scope this rule at the SIEM level per host rather than attempting a content-based filter
- Manual administrative use of a Ghostscript-dependent tool loaded into a long-running IIS worker process (rare, validate against known baselines)
level: critical