Detect CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure in Splunk
Detects exploitation of CVE-2026-21510, a Microsoft Windows Shell protection mechanism failure (CWE-693) that allows attackers to bypass security controls enforced by the Windows Shell. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may abuse this flaw to execute unauthorized code, bypass security prompts, or escalate privileges via crafted shell interactions.
MITRE ATT&CK
SPL Detection Query
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| eval ParentBasename=mvindex(split(ParentImage, "\\"), -1)
| eval ChildBasename=mvindex(split(Image, "\\"), -1)
| where (ParentBasename IN ("winlogon.exe", "services.exe", "svchost.exe", "lsass.exe", "csrss.exe") AND ChildBasename IN ("explorer.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"))
OR (ChildBasename="explorer.exe" AND (CommandLine="*/factory*" OR CommandLine="*-Embedding*") AND ParentBasename NOT IN ("userinit.exe", "explorer.exe"))
OR (ParentBasename="explorer.exe" AND ChildBasename IN ("cmd.exe", "powershell.exe", "pwsh.exe") AND NOT ParentCommandLine IN ("*open*", "*explore*"))
| eval RiskScore=case(
ParentBasename IN ("winlogon.exe","services.exe","svchost.exe","lsass.exe","csrss.exe") AND ChildBasename IN ("explorer.exe","cmd.exe","powershell.exe"), 90,
ChildBasename="explorer.exe" AND like(CommandLine, "%/factory%"), 80,
1=1, 70
)
| table _time, host, User, ParentImage, Image, CommandLine, ParentCommandLine, ProcessId, ParentProcessId, RiskScore
| sort - RiskScore _timeSplunk query using Sysmon EventCode 1 (Process Create) to identify Windows Shell protection bypass patterns. Detects shell processes spawning from anomalous parents and suspicious explorer.exe launch arguments linked to CVE-2026-21510.
Data Sources
Required Sourcetypes
False Positives & Tuning
- SCCM or Intune management agents spawning shell processes for software deployment
- Legitimate COM activation of explorer.exe with /factory argument by registered shell extensions
- Pentest or red team activities using authorized tooling that mimics shell invocation patterns
- Automated build or CI/CD pipeline agents running on Windows hosts that invoke shell commands
Other platforms for CVE-2026-21510
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Shell Spawn from Winlogon Context
Expected signal: Sysmon Event ID 1: cmd.exe process with ParentImage path containing winlogon.exe or SYSTEM session identifier; Windows Security Event 4688 showing cmd.exe process creation under SYSTEM account.
- Test 2Explorer.exe Factory Flag Instantiation
Expected signal: Sysmon Event ID 1: explorer.exe process with CommandLine containing /factory and ParentImage of powershell.exe; corresponding network or registry activity from the new explorer instance.
- Test 3PowerShell Encoded Command via Shell Bypass Chain
Expected signal: Sysmon Event ID 1: powershell.exe with -EncodedCommand in CommandLine, parent cmd.exe; Sysmon Event ID 3: any outbound connection if payload includes network activity.
- Test 4Shell Bypass Followed by Discovery Commands
Expected signal: Sysmon Event IDs 1 for cmd.exe (parent: psexec/SYSTEM), then whoami.exe and ipconfig.exe as children within 30 seconds; all events share the same host identifier.
Response Playbook
Triage
- Confirm the affected host is running a Windows version subject to CVE-2026-21510 and verify patch status against Microsoft's February 2026 Patch Tuesday updates.
- Review the process tree for the flagged event: identify the initiating process, its command line, the spawned shell child, and any subsequent child processes to determine if this is a legitimate administrative action or active exploitation.
- Check the user account associated with the process launch — determine if the account is a service account, privileged admin, or standard user, and review recent logon events (Event ID 4624/4625) for signs of credential compromise.
- Correlate with network events: inspect outbound connections from the spawned shell process for C2 indicators, DNS lookups to suspicious domains, or data exfiltration patterns within ±15 minutes of the alert.
Containment
- Isolate the affected endpoint via EDR network containment or firewall rule to prevent lateral movement while preserving forensic state for investigation.
- Terminate any confirmed malicious shell or child processes spawned as a result of the bypass, and revoke active sessions for the implicated user account pending investigation.
- If exploitation is confirmed, enforce emergency patching of CVE-2026-21510 across the environment, prioritizing internet-exposed and privileged-access workstations.
Evidence Collection
- Capture a full memory dump of the affected process and its parent before termination to preserve in-memory shellcode, injected modules, or staged payloads for forensic analysis.
- Collect Sysmon logs (Event IDs 1, 3, 7, 8, 10, 11) and Windows Security Event Logs (Event IDs 4688, 4624, 4648) from the affected host covering the 30-minute window around the alert timestamp.
- Preserve prefetch files, shimcache, amcache, and registry run keys to reconstruct execution history and identify persistence mechanisms established post-exploitation.
Escalation Criteria
- !Escalate immediately if the spawned shell process initiates lateral movement (e.g., net use, PsExec, WMI remote execution) or connects to a known threat intelligence-flagged IP or domain.
- !Escalate to incident response if multiple hosts exhibit the same pattern within a short timeframe, indicating automated exploitation or worm-like propagation leveraging CVE-2026-21510.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Event Log: Security Event 4688 (Process Creation with command line auditing enabled) showing anomalous parent-child process relationships involving shell processes - >
Sysmon Event ID 1 logs capturing full command-line arguments, hashes, and GUID-linked process trees for shell spawn events - >
Prefetch files (C:\Windows\Prefetch\) for cmd.exe, powershell.exe, explorer.exe showing first/last execution timestamps correlating with exploit window - >
Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU and ShellBags entries for signs of shell manipulation - >
Amcache.hve entries recording execution of any dropped binaries following the shell bypass
Tuning Guidance
Begin by establishing a baseline of legitimate explorer.exe child process spawning in your environment over 14 days before deploying this detection at high confidence. Whitelist known software management tools (SCCM, Intune, Tanium) by their parent process hashes or signing certificates rather than by name to avoid bypass via renamed binaries. If COM-based shell extensions with /factory or -Embedding are common in your environment, filter by verified publisher signing certificate of the initiating process. Tune the detection to alert only on unsigned or low-prevalence binaries spawned after the shell bypass event to reduce alert fatigue while maintaining detection fidelity for novel exploitation.
Hunting Queries
Threat hunt for encoded or obfuscated command execution via shell children of explorer.exe — a common post-exploitation pattern following CVE-2026-21510 shell bypass. Low host count (<=3) filters to rare, potentially targeted activity.
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "-e ", "IEX", "Invoke-Expression", "DownloadString", "WebClient", "http://", "https://")
| summarize Count=count(), Hosts=dcount(DeviceName) by FileName, ProcessCommandLine
| where Hosts <= 3
| order by Count descindex=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 ParentImage="*explorer.exe*"
| eval Image=lower(Image), CommandLine=lower(CommandLine)
| where like(Image, "%cmd.exe") OR like(Image, "%powershell.exe") OR like(Image, "%wscript.exe") OR like(Image, "%mshta.exe")
| where like(CommandLine, "%-enc%") OR like(CommandLine, "%iex%") OR like(CommandLine, "%downloadstring%") OR like(CommandLine, "%webclient%")
| stats count dc(host) as UniqueHosts by Image CommandLine
| where UniqueHosts <= 3
| sort - countAtomic Red Team Tests
Simulates a shell process (cmd.exe) being spawned from winlogon.exe context to test detection of anomalous parent-child shell relationships associated with CVE-2026-21510.
Command
# Run in an elevated lab environment only
# Use PsExec to impersonate winlogon.exe session context and spawn cmd.exe
psexec.exe -s -i cmd.exe /c "echo CVE-2026-21510 test > C:\Temp\cve_test.txt"Cleanup
del C:\Temp\cve_test.txtExpected Telemetry
Sysmon Event ID 1: cmd.exe process with ParentImage path containing winlogon.exe or SYSTEM session identifier; Windows Security Event 4688 showing cmd.exe process creation under SYSTEM account.
Expected Detection
Alert fires on KQL/SPL queries matching cmd.exe spawned from winlogon.exe parent; CrowdStrike and Elastic detections trigger on ProcessRollup2/process.start event with matching parent-child pair.
Tests detection of explorer.exe launched with the /factory COM activation flag from an unexpected parent process, mimicking the shell bypass instantiation method.
Command
# Launch explorer.exe with /factory flag from PowerShell (non-userinit parent)
powershell.exe -NoProfile -Command "Start-Process 'C:\Windows\explorer.exe' -ArgumentList '/factory,{75DFF2B7-6936-4C06-A8BB-676A7B00B24B}' -WindowStyle Hidden"Cleanup
Stop-Process -Name explorer -Force; Start-Process explorer.exeExpected Telemetry
Sysmon Event ID 1: explorer.exe process with CommandLine containing /factory and ParentImage of powershell.exe; corresponding network or registry activity from the new explorer instance.
Expected Detection
KQL and SPL detection rules trigger on explorer.exe with /factory in command line and parent not matching userinit.exe; Chronicle YARA-L rule fires on process launch event matching the pattern.
Simulates the post-exploitation stage following a shell bypass: launching encoded PowerShell from an unexpected shell parent to test the hunting query for obfuscated execution.
Command
# Encode a benign command and launch via cmd.exe spawned from a service context (lab only)
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Host "CVE-2026-21510 post-exploit simulation"'))
cmd.exe /c powershell.exe -EncodedCommand $encodedCleanup
No persistent changes; process exits after execution.Expected Telemetry
Sysmon Event ID 1: powershell.exe with -EncodedCommand in CommandLine, parent cmd.exe; Sysmon Event ID 3: any outbound connection if payload includes network activity.
Expected Detection
Hunting query triggers on -EncodedCommand flag in PowerShell CommandLine with explorer.exe or cmd.exe parent and low host prevalence; base detections may fire depending on grandparent process context.
Tests the Elastic EQL sequence detection by simulating the two-stage pattern: a shell process from a system parent followed immediately by discovery commands (whoami, ipconfig).
Command
# Stage 1: simulate shell from service context (use PsExec in lab)
psexec.exe -s cmd.exe /c "timeout /t 2 && whoami && ipconfig /all > C:\Temp\discovery.txt"Cleanup
del C:\Temp\discovery.txtExpected Telemetry
Sysmon Event IDs 1 for cmd.exe (parent: psexec/SYSTEM), then whoami.exe and ipconfig.exe as children within 30 seconds; all events share the same host identifier.
Expected Detection
Elastic EQL sequence rule fires on the two-stage chain within the 30-second maxspan window; QRadar and Sumo Logic queries surface the cmd.exe spawn from SYSTEM context.