Detect Microsoft Windows Information Disclosure (CVE-2026-20805) in Sumo Logic CSE
Detects exploitation of CVE-2026-20805, a Microsoft Windows information disclosure vulnerability (CWE-200) that allows attackers to access sensitive memory or kernel data. This vulnerability is actively exploited in the wild (CISA KEV). Successful exploitation may expose credentials, memory contents, or system information that enables privilege escalation or lateral movement.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=windows* OR _sourceCategory=sysmon*
| parse field=_raw "EventID=*" as event_id nodrop
| parse field=_raw "CommandLine=*" as command_line nodrop
| parse field=_raw "IntegrityLevel=*" as integrity_level nodrop
| parse field=_raw "ObjectName=*" as object_name nodrop
| parse field=_raw "User=*" as user_name nodrop
| parse field=_raw "Computer=*" as computer_name nodrop
| where (event_id in ("4663", "4656") and (
object_name matches "*lsass*" or
object_name matches "*\\SAM" or
object_name matches "*\\SECURITY" or
object_name matches "*ntds.dit*"
))
OR (
command_line matches "*NtQuerySystemInformation*" or
command_line matches "*ZwQuerySystemInformation*" or
command_line matches "*ReadProcessMemory*"
)
| where integrity_level in ("Low", "Medium") or integrity_level = ""
| timeslice 1h
| count as event_count by _timeslice, computer_name, user_name, event_id, command_line, object_name, integrity_level
| where event_count >= 1
| sort by event_count desc
| fields _timeslice, computer_name, user_name, event_id, command_line, object_name, integrity_level, event_countSumo Logic query detecting CVE-2026-20805 exploitation by parsing Windows Security and Sysmon logs for low-integrity processes performing sensitive object access or invoking kernel information disclosure APIs.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint security software performing kernel-level process enumeration for threat detection
- Authorized red team or penetration testing activities targeting Windows systems
- System monitoring agents that regularly query OS-level metrics at low integrity
- Development and debugging tools such as WinDbg or Visual Studio performing process introspection
Other platforms for CVE-2026-20805
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NtQuerySystemInformation via PowerShell P/Invoke
Expected signal: Sysmon Event ID 1 (Process Create) for powershell.exe; Windows Event ID 4688 if process command line auditing is enabled; EDR process telemetry capturing the PowerShell invocation with P/Invoke patterns.
- Test 2LSASS Handle Open with VM_READ Access
Expected signal: Sysmon Event ID 10 (ProcessAccess) with TargetImage=lsass.exe, GrantedAccess=0x0010 (PROCESS_VM_READ), SourceImage=powershell.exe; Windows Security Event ID 4656 for handle request to LSASS process object.
- Test 3Sensitive Registry Hive Access from Low Integrity Context
Expected signal: Windows Security Event ID 4663 with ObjectName containing SECURITY hive path; Sysmon Event ID 1 for process creation with low integrity level token; Event ID 4656 for registry key open with sensitive access mask.
Response Playbook
Triage
- Identify the process name, PID, integrity level, and parent process for the triggering event to determine whether the process is a known legitimate application or an anomalous binary.
- Check whether the affected host has applied the Microsoft patch for CVE-2026-20805 by querying patch management systems (e.g., WSUS, Intune, SCCM) or running 'wmic qfe list' on the endpoint.
- Correlate the alert timestamp with recent authentication events (Event IDs 4624, 4625, 4648) to determine if the information disclosure activity preceded or followed a logon anomaly, indicating potential credential harvesting.
- Review the process tree for the triggering process to identify whether it was spawned by a browser, email client, Office application, or other user-facing software, which would indicate a user-triggered exploit delivery.
Containment
- If the host shows confirmed exploitation indicators, isolate it from the network using EDR network containment or firewall rules to prevent lateral movement while preserving forensic state for investigation.
- Revoke and rotate any credentials or tokens that were accessible from the compromised process context, including cached credentials in LSASS, Kerberos tickets, and any secrets readable at the process integrity level.
Evidence Collection
- Collect a memory dump of the suspected malicious process and LSASS (if accessible) using tools such as ProcDump, WinPmem, or the EDR's built-in memory acquisition capability to preserve volatile evidence of exploitation.
- Preserve Windows Event Logs (Security, System, Sysmon) and prefetch files from the affected host, along with any relevant MFT entries and $LogFile artifacts, to reconstruct the exploitation timeline.
Escalation Criteria
- !Escalate immediately if the triggering process is associated with known malware families (e.g., detected by AV/EDR), or if there is evidence of LSASS credential dumping or NTDS.dit exfiltration following the information disclosure event.
- !Escalate if the affected host is a domain controller, privileged access workstation, or serves a critical business function, as the impact of credential exposure from these systems is significantly higher.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Event ID 4663/4656: Object access events for SAM, SECURITY hive, or LSASS process handle requests from unexpected processes. - >
Sysmon Event ID 10 (ProcessAccess): Records when a process opens a handle to another process with suspicious access rights (e.g., PROCESS_VM_READ on LSASS). - >
Prefetch files for the malicious process binary in C:\Windows\Prefetch, providing evidence of execution timing and loaded DLLs. - >
Windows Security event ID 4688 with process command line logging enabled, capturing invocation of exploit payload with relevant API arguments.
Tuning Guidance
Reduce false positives by building an allowlist of known-good processes (EDR agents, antivirus, monitoring tools) that legitimately call NtQuerySystemInformation or access LSASS. Apply the detection only to processes signed by untrusted or unknown publishers, and require at least two correlated indicators (low integrity + sensitive API + sensitive file access) before alerting. Adjust the correlation window (currently 10 minutes in YARA-L) based on observed attacker dwell time in your environment. Exclude service accounts and SYSTEM context from file access checks, as these are expected to access sensitive stores routinely.
Hunting Queries
Threat hunt for processes at low or medium integrity attempting to open handles to LSASS with suspicious access rights (VM_READ, ALL_ACCESS) or invoking kernel enumeration APIs — indicators of CVE-2026-20805 pre-exploitation reconnaissance or active exploitation.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessIntegrityLevel in~ ("Low", "Medium")
| where ProcessCommandLine has_any ("NtQuerySystemInformation", "ZwQuerySystemInformation", "OpenProcess", "ReadProcessMemory")
| summarize count() by DeviceName, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, ProcessCommandLine
| order by count_ descindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| where GrantedAccess IN ("0x1010", "0x1410", "0x40", "0x1fffff")
| where match(TargetImage, "(?i)lsass\.exe")
| stats count by _time, host, SourceImage, TargetImage, GrantedAccess, CallTrace
| sort - countAtomic Red Team Tests
Simulates the information disclosure component of CVE-2026-20805 by invoking NtQuerySystemInformation from a medium-integrity PowerShell process to enumerate system handle information, mimicking attacker reconnaissance behavior.
Command
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$code = @'
[DllImport(\"ntdll.dll\")]
public static extern int NtQuerySystemInformation(int SystemInformationClass, IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
'@; $type = Add-Type -MemberDefinition $code -Name 'NtDll' -Namespace 'Win32' -PassThru; $buf = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1024*1024); $len = 0; $ret = $type::NtQuerySystemInformation(16, $buf, 1024*1024, [ref]$len); Write-Output \"NtQuerySystemInformation returned: $ret, length: $len\"; [System.Runtime.InteropServices.Marshal]::FreeHGlobal($buf)"Cleanup
No persistent artifacts created. Close the PowerShell process if still running.Expected Telemetry
Sysmon Event ID 1 (Process Create) for powershell.exe; Windows Event ID 4688 if process command line auditing is enabled; EDR process telemetry capturing the PowerShell invocation with P/Invoke patterns.
Expected Detection
KQL and SPL rules should trigger on NtQuerySystemInformation in the PowerShell command line at medium integrity level.
Simulates an attacker opening a handle to LSASS with PROCESS_VM_READ access rights, which is a precursor to credential dumping and is consistent with information disclosure exploitation that exposes LSASS memory.
Command
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$code = @'
[DllImport(\"kernel32.dll\")]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport(\"kernel32.dll\")]
public static extern bool CloseHandle(IntPtr hObject);
'@; $type = Add-Type -MemberDefinition $code -Name 'Kernel32' -Namespace 'Win32' -PassThru; $lsass = Get-Process lsass; $handle = $type::OpenProcess(0x0010, $false, $lsass.Id); if ($handle -ne [IntPtr]::Zero) { Write-Output \"Handle opened: $handle\"; $type::CloseHandle($handle) } else { Write-Output \"Access denied (expected in hardened env)\" }"Cleanup
Handle is closed within the script. No persistent changes made.Expected Telemetry
Sysmon Event ID 10 (ProcessAccess) with TargetImage=lsass.exe, GrantedAccess=0x0010 (PROCESS_VM_READ), SourceImage=powershell.exe; Windows Security Event ID 4656 for handle request to LSASS process object.
Expected Detection
Chronicle YARA-L and EQL sequence rules should fire on the correlated process launch and LSASS access events within the correlation window.
Tests detection of unauthorized access to the Windows Security registry hive (HKLM\SECURITY) from a low-integrity process context, simulating information disclosure that could expose LSA secrets or cached credentials as part of CVE-2026-20805 exploitation.
Command
cmd.exe /c "icacls %TEMP%\test_low_integrity.exe /setintegritylevel Low & %TEMP%\test_low_integrity.exe" & echo reg query HKLM\SECURITY /s > %TEMP%\reg_query.bat & psexec -l -d cmd.exe /c %TEMP%\reg_query.batCleanup
del %TEMP%\test_low_integrity.exe %TEMP%\reg_query.bat 2>nul & exit 0Expected Telemetry
Windows Security Event ID 4663 with ObjectName containing SECURITY hive path; Sysmon Event ID 1 for process creation with low integrity level token; Event ID 4656 for registry key open with sensitive access mask.
Expected Detection
SPL and QRadar AQL queries should detect the Event ID 4663/4656 correlated with low integrity level, triggering the sensitive registry access detection branch.