Cve 2026 66804

KQL detection rule by GossiTheDog · GPL-3.0

CVE-2026-66804 exploitation MITRE ATT&CK Mapping Tactics: - Privilege Escalation - Defense Evasion - Execution Techniques: - T1068 Exploitation for Privilege Escalation - T1574.001 Hijack Execution Flow: DLL Search Order Hijacking - T1134.001 Access Token Manipulation: Token Impersonation/Theft - T1059.003 Command and Scripting Interpreter: Windows Command Shell - T1059.001 Command and Scripting Interpreter: PowerShell

// CVE-2026-66804 exploitation
//
// MITRE ATT&CK Mapping
//
// Tactics:
// - Privilege Escalation
// - Defense Evasion
// - Execution
//
// Techniques:
// - T1068  Exploitation for Privilege Escalation
// - T1574.001  Hijack Execution Flow: DLL Search Order Hijacking
// - T1134.001  Access Token Manipulation: Token Impersonation/Theft
// - T1059.003  Command and Scripting Interpreter: Windows Command Shell
// - T1059.001  Command and Scripting Interpreter: PowerShell

// Detection 1 - CVE-2026-66804 - DLL drop in CrossDevice directory
DeviceFileEvents
| where FolderPath startswith @"C:\ProgramData\CrossDevice"
| where FileName endswith ".dll"

// Detection 2 - CVE-2026-66804 - DLL load and process spawn

let CrossDeviceDll =
DeviceImageLoadEvents
| where FolderPath startswith @"C:\ProgramData\CrossDevice"
| project DeviceId, DeviceName, LoadTime=Timestamp;
let ServiceShell =
DeviceProcessEvents
| where FileName in ("cmd.exe","powershell.exe")
| where AccountName in ("SYSTEM","LOCAL SERVICE")
| project DeviceId, ShellTime=Timestamp, FileName;
CrossDeviceDll
| join kind=inner ServiceShell on DeviceId
| where ShellTime between (LoadTime .. LoadTime + 10m)
| project DeviceName, LoadTime, ShellTime, FileName

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1b61a0f0-a000-4454-b9d7-efa961683421

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion