[[ fm.text ]] Click here

SharePoint worker process spawning shell after deserialization RCE (CVE-2026-45659) - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

IIS worker or timer service spawning a shell or LOLBin with strong post-exploitation indicators, consistent with CVE-2026-45659 deserialization RCE. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity. Détecte le worker IIS ou le service timer de SharePoint lançant un shell ou un LOLBin avec des indicateurs forts de post-exploitation, compatible avec une RCE par désérialisation de la CVE-2026-45659. Le SOC L1 doit vérifier le parent, l’enfant, la ligne de commande, l’utilisateur, le site concerné et l’activité réseau ou fichier associée.

title: SharePoint worker process spawning shell after deserialization RCE (CVE-2026-45659) - STRICT
id: 4cedb4e8-e32f-4207-b62c-7868b9bdaee7
status: experimental
description: |
  IIS worker or timer service spawning a shell or LOLBin with strong post-exploitation indicators, consistent with CVE-2026-45659 deserialization RCE. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte le worker IIS ou le service timer de SharePoint lançant un shell ou un LOLBin avec des indicateurs forts de post-exploitation, compatible avec une RCE par désérialisation de la CVE-2026-45659. Le SOC L1 doit vérifier le parent, l’enfant, la ligne de commande, l’utilisateur, le site concerné et l’activité réseau ou fichier associée.
related:
  - id: df7dfad8-8012-4ece-b73e-a1769157ccc6
    type: similar

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-07-03
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45659
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1027
  - cve.2026-45659

logsource:
  product: windows
  category: process_creation

detection:
  # No public exploitation endpoint or gadget chain is documented for this CVE at the time
  # this rule was written. The parent/child spawn pattern below targets the post-exploitation
  # phase, which is identical across SharePoint deserialization RCEs regardless of the entry
  # vector, and does not depend on knowing the exact HTTP request that triggered it.
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.EXE'
      - '\MSOWSE.EXE'

  selection_child_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\python.exe'
      - '\pythonw.exe'
      - '\perl.exe'
      - '\ruby.exe'
      - '\node.exe'
      - '\php.exe'
      - '\bash.exe'
      - '\sh.exe'

  selection_strong_indicators:
    CommandLine|contains:
      # Encoded commands
      - ' -enc '
      - ' -EncodedCommand '
      - ' -e '
      - 'FromBase64String'
      # PowerShell suspicious patterns typical of a deserialization gadget-chain payload
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'Net.WebClient'
      - 'System.Net.WebClient'
      # Download cradles
      - 'bitsadmin '
      - 'certutil -urlcache'
      - 'curl '
      - 'wget '
      - 'msxsl '
      - ' -Command '

  # LOLBins spawned directly by the SharePoint process without a shell intermediary.
  selection_direct_lolbin:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msiexec.exe'
      - '\installutil.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'

  # Required companion for the direct_lolbin branch: SharePoint legitimately invokes
  # rundll32/regsvr32 for COM registration during solution deployment. Without a suspicious
  # network/encoding argument, a bare invocation is expected admin activity, not exploitation.
  selection_direct_lolbin_suspicious_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-urlcache'
      - '-decode'
      - 'FromBase64'
      - ' -enc '
      - ' -e '
      - 'scrobj.dll'
      - 'comsvcs'
      - '/i:http'
      - '/i:ftp'

  filter_known_admin_maintenance:
    CommandLine|contains:
      - 'Update-SPSolution'
      - 'Install-SPSolution'
      - 'Add-SPSolution'
      - 'Upgrade-SPFarm'
      - 'Get-SPWebApplication'
      - 'Backup-SPFarm'
      - 'Restore-SPFarm'
      - 'Mount-SPContentDatabase'
      - 'Dismount-SPContentDatabase'
    User|contains:
      - 'svc_'

  condition: >
    selection_parent and
    (
      (selection_child_shell and selection_strong_indicators) or
      (selection_direct_lolbin and selection_direct_lolbin_suspicious_cli)
    ) and
    not filter_known_admin_maintenance

fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
  - User
  - LogonId
  - ProcessId
  - ParentProcessId
  - ComputerName
  - UtcTime

falsepositives:
  - Legitimate SharePoint administrative tasks executing PowerShell from w3wp/OWSTIMER contexts (rare but possible)
  - Authorized deployment automation (solutions/packages) during maintenance windows
  - Security testing with proper authorization

level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

abbef9a7-f942-4e6a-a605-dde7036b21ff

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion