CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure

let SuspiciousShellParents = dynamic(["winlogon.exe", "services.exe", "svchost.exe", "lsass.exe", "csrss.exe"]);
let ShellProcesses = dynamic(["explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName in~ (ShellProcesses) and InitiatingProcessFileName in~ (SuspiciousShellParents))
   or (FileName =~ "explorer.exe" and ProcessCommandLine has_any ("/factory", "/select", "-Embedding") and InitiatingProcessFileName !in~ ("userinit.exe", "explorer.exe"))
   or (InitiatingProcessFileName =~ "explorer.exe" and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") and not(InitiatingProcessCommandLine has_any ("open", "explore")))
| extend RiskScore = case(
    InitiatingProcessFileName in~ (SuspiciousShellParents) and FileName in~ (ShellProcesses), 90,
    FileName =~ "explorer.exe" and ProcessCommandLine has "/factory", 80,
    70
  )
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, ProcessId, RiskScore, ReportId
| order by RiskScore desc, TimeGenerated desc

index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| eval ParentBasename=mvindex(split(ParentImage, "\\"), -1)
| eval ChildBasename=mvindex(split(Image, "\\"), -1)
| where (ParentBasename IN ("winlogon.exe", "services.exe", "svchost.exe", "lsass.exe", "csrss.exe") AND ChildBasename IN ("explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
  OR (ChildBasename="explorer.exe" AND (CommandLine="*/factory*" OR CommandLine="*-Embedding*") AND ParentBasename NOT IN ("userinit.exe", "explorer.exe"))
  OR (ParentBasename="explorer.exe" AND ChildBasename IN ("cmd.exe", "powershell.exe", "pwsh.exe") AND NOT ParentCommandLine IN ("*open*", "*explore*"))
| eval RiskScore=case(
    ParentBasename IN ("winlogon.exe","services.exe","svchost.exe","lsass.exe","csrss.exe") AND ChildBasename IN ("explorer.exe","cmd.exe","powershell.exe"), 90,
    ChildBasename="explorer.exe" AND like(CommandLine, "%/factory%"), 80,
    1=1, 70
  )
| table _time, host, User, ParentImage, Image, CommandLine, ParentCommandLine, ProcessId, ParentProcessId, RiskScore
| sort - RiskScore _time

sequence by host.name with maxspan=30s
  [process where event.action == "start"
    and process.name in~ ("explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    and process.parent.name in~ ("winlogon.exe", "services.exe", "svchost.exe", "lsass.exe", "csrss.exe")]
  [process where event.action == "start"
    and process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "ipconfig.exe")
    and process.parent.name in~ ("explorer.exe", "cmd.exe", "powershell.exe")]

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "processPath", "parentProcessPath", "commandLine", "parentCommandLine", logsourceid
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%Windows%'
  AND CATEGORYNAME(category) ILIKE '%Process%'
  AND (
    (LOWER("parentProcessPath") ILIKE '%winlogon.exe' OR LOWER("parentProcessPath") ILIKE '%services.exe' OR LOWER("parentProcessPath") ILIKE '%svchost.exe' OR LOWER("parentProcessPath") ILIKE '%lsass.exe')
    AND (LOWER("processPath") ILIKE '%explorer.exe' OR LOWER("processPath") ILIKE '%cmd.exe' OR LOWER("processPath") ILIKE '%powershell.exe' OR LOWER("processPath") ILIKE '%wscript.exe')
  )
  OR (
    LOWER("processPath") ILIKE '%explorer.exe'
    AND (LOWER("commandLine") ILIKE '%/factory%' OR LOWER("commandLine") ILIKE '%-embedding%')
    AND LOWER("parentProcessPath") NOT ILIKE '%userinit.exe'
  )
LAST 7 DAYS
ORDER BY EventTime DESC

_sourceCategory=windows/sysmon (EventCode=1)
| parse "<Image>*</Image>" as process_image
| parse "<ParentImage>*</ParentImage>" as parent_image
| parse "<CommandLine>*</CommandLine>" as command_line
| parse "<ParentCommandLine>*</ParentCommandLine>" as parent_cmd
| parse "<User>*</User>" as username
| parse "<UtcTime>*</UtcTime>" as event_time
| eval process_name = toUpperCase(substring(process_image, length(process_image) - indexOf(reverse(process_image), "\\") + 1))
| eval parent_name = toUpperCase(substring(parent_image, length(parent_image) - indexOf(reverse(parent_image), "\\") + 1))
| where (parent_name in ("WINLOGON.EXE", "SERVICES.EXE", "SVCHOST.EXE", "LSASS.EXE", "CSRSS.EXE") and process_name in ("EXPLORER.EXE", "CMD.EXE", "POWERSHELL.EXE", "PWSH.EXE", "WSCRIPT.EXE", "CSCRIPT.EXE", "MSHTA.EXE"))
  or (process_name = "EXPLORER.EXE" and (matches(command_line, "(?i).*\/factory.*") or matches(command_line, "(?i).*-Embedding.*")) and parent_name != "USERINIT.EXE")
| count by _sourceHost, username, parent_name, process_name, command_line
| sort by _count desc

rule cve_2026_21510_windows_shell_bypass {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-21510 Windows Shell protection mechanism failure exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname
    $proc.target.process.file.full_path = /(?i)(explorer\.exe|cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)$/
    $proc.principal.process.file.full_path = /(?i)(winlogon\.exe|services\.exe|svchost\.exe|lsass\.exe|csrss\.exe)$/

  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("winlogon.exe", "services.exe", "svchost.exe", "lsass.exe", "csrss.exe")
  AND FileName in ("explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| OR (
    FileName = "explorer.exe"
    AND (CommandLine = "*/factory*" OR CommandLine = "*-Embedding*")
    AND ParentBaseFileName != "userinit.exe"
  )
| eval RiskLevel = if(ParentBaseFileName in ("lsass.exe", "csrss.exe"), "CRITICAL", "HIGH")
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ParentCommandLine, TargetProcessId, ContextProcessId, RiskLevel
| sort - timestamp