Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-20963)

union DeviceNetworkEvents, DeviceProcessEvents
| where Timestamp > ago(7d)
| where DeviceName has_any ("sharepoint", "wfe", "app") or InitiatingProcessName has_any ("w3wp.exe", "owstimer.exe", "spmigrationjob.exe")
| where (ActionType == "InboundConnectionAccepted" and RemotePort in (80, 443)) or (FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe") and InitiatingProcessParentFileName =~ "w3wp.exe")
| extend Indicator = case(
    FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe") and InitiatingProcessParentFileName =~ "w3wp.exe", "SharePoint worker spawned suspicious child process",
    ActionType == "InboundConnectionAccepted", "Inbound connection to SharePoint host",
    "Unknown"
)
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, RemoteIP, RemotePort, Indicator

index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent=lower(ParentImage), proc=lower(Image), cmdline=lower(CommandLine)
| where (parent="*w3wp.exe*" AND proc IN ("*powershell.exe*", "*cmd.exe*", "*wscript.exe*", "*cscript.exe*", "*mshta.exe*", "*certutil.exe*"))
   OR (EventCode=4688 AND parent="*w3wp.exe*" AND proc IN ("*powershell.exe*", "*cmd.exe*"))
| eval risk_reason=case(
    match(proc, "powershell"), "PowerShell spawned from IIS worker",
    match(proc, "certutil"), "certutil spawned from IIS worker - possible payload download",
    match(proc, "mshta"), "mshta spawned from IIS worker - possible script execution",
    true(), "Suspicious child process of w3wp.exe"
)
| table _time, host, parent, proc, cmdline, risk_reason
| sort -_time

sequence by host.name with maxspan=30s
  [process where process.name : "w3wp.exe" and process.parent.name : ("svchost.exe", "services.exe")]
  [process where process.parent.name : "w3wp.exe" and process.name : ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, username, "Process Name", "Parent Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND ("Parent Process Name" ILIKE '%w3wp.exe%'
       AND "Process Name" ILIKE ANY ('%powershell.exe%', '%cmd.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%certutil.exe%', '%bitsadmin.exe%'))
LAST 7 DAYS
ORDER BY devicetime DESC

_sourceCategory=windows/events OR _sourceCategory=sysmon
| where (ParentImage matches "*w3wp.exe*" and (Image matches "*powershell.exe*" or Image matches "*cmd.exe*" or Image matches "*wscript.exe*" or Image matches "*cscript.exe*" or Image matches "*mshta.exe*" or Image matches "*certutil.exe*" or Image matches "*bitsadmin.exe*"))
| fields _messageTime, _sourceHost, ParentImage, Image, CommandLine
| sort by _messageTime desc

rule sharepoint_deserialization_child_process_cve_2026_20963 {
  meta:
    author = "df00tech"
    description = "Detects SharePoint w3wp.exe spawning suspicious child processes - CVE-2026-20963"
    severity = "CRITICAL"
    priority = "HIGH"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /w3wp\.exe$/i
    $proc.target.process.file.full_path = /(powershell|cmd|wscript|cscript|mshta|certutil|bitsadmin|regsvr32)\.exe$/i
  condition:
    $proc
}

event_type=ProcessRollup2
| filter ParentBaseFileName="w3wp.exe"
  AND FileName IN ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe")
| eval RiskReason=case(
    FileName="powershell.exe", "PowerShell spawned by SharePoint IIS worker",
    FileName="certutil.exe", "certutil spawned by IIS worker - potential payload staging",
    FileName="mshta.exe", "mshta spawned by IIS worker - script execution risk",
    true(), "Suspicious binary spawned by w3wp.exe"
  )
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RiskReason
| sort -timestamp