Detect Microsoft Windows Type Confusion Vulnerability (CVE-2026-21519) in Microsoft Sentinel
Detects exploitation of CVE-2026-21519, a type confusion vulnerability (CWE-843) in Microsoft Windows. Type confusion vulnerabilities occur when code allocates or initializes a resource using one type but accesses it using an incompatible type, leading to out-of-bounds memory access, arbitrary code execution, or privilege escalation. This CVE is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
KQL Detection Query
union SecurityEvent, DeviceProcessEvents, DeviceEvents
| where TimeGenerated >= ago(7d)
| where (EventID in (4688, 4697, 7045) or ActionType in ("ProcessCreated", "DriverLoad", "ImageLoaded"))
| extend ProcessCmdLine = coalesce(CommandLine, ProcessCommandLine, "")
| extend ParentProcessName = coalesce(ParentProcessName, InitiatingProcessFileName, "")
| where (
(EventID == 4688 and ProcessCmdLine has_any ("SeDebugPrivilege", "SeImpersonatePrivilege", "SeAssignPrimaryTokenPrivilege"))
or (ActionType == "DriverLoad" and not(InitiatingProcessFileName has_any ("MsMpEng.exe", "services.exe", "wininit.exe")))
or (ActionType == "ProcessCreated" and InitiatingProcessFileName in~ ("lsass.exe", "winlogon.exe", "csrss.exe") and not(FileName in~ ("conhost.exe", "werfault.exe")))
or (EventID == 4697 and ServiceFileName has_any (".tmp", "\\AppData\\", "\\Temp\\"))
)
| extend RiskScore = case(
ActionType == "DriverLoad" and not(InitiatingProcessFileName has_any ("MsMpEng.exe", "services.exe")), 90,
ActionType == "ProcessCreated" and InitiatingProcessFileName in~ ("lsass.exe", "winlogon.exe"), 85,
EventID == 4697 and ServiceFileName has_any (".tmp", "\\AppData\\"), 80,
60
)
| project TimeGenerated, Computer, AccountName, ProcessName = coalesce(NewProcessName, FileName, ""), ParentProcessName, ProcessCmdLine, ActionType, EventID, RiskScore
| sort by RiskScore desc, TimeGenerated descDetects indicators of Windows type confusion exploitation including abnormal privilege token manipulation, suspicious driver loads from non-system processes, unusual child processes spawned by protected system processes, and services installed from temporary locations.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate driver installations from third-party security software or hardware vendors
- System administrators manually installing services or drivers for maintenance
- Software update processes temporarily writing executables to AppData or Temp directories
- Debugging tools legitimately requesting SeDebugPrivilege during authorized testing
Other platforms for CVE-2026-21519
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Anomalous Child Process from Winlogon
Expected signal: Sysmon EventID 1 showing cmd.exe or similar process with an unexpected parent, Windows Security EventID 4688 capturing the new process creation with command line arguments.
- Test 2Privilege Token Enumeration via Command Line
Expected signal: Windows Security EventID 4688 with CommandLine containing privilege-related arguments, Sysmon EventID 1 capturing the full process creation with integrity level.
- Test 3Suspicious Service Installation from Temp Directory
Expected signal: Windows System EventID 7045 (new service installed) with ServiceImagePath pointing to %TEMP%, Sysmon EventID 13 capturing registry writes for the new service key under HKLM\SYSTEM\CurrentControlSet\Services.
- Test 4Unsigned Driver Load Simulation via Sysmon
Expected signal: Sysmon EventID 6 (DriverLoad) with the ImageLoaded path pointing to a non-standard location and the initiating process being a user-mode application rather than services.exe or wininit.exe.
Response Playbook
Triage
- Identify the affected host and confirm the Windows version; cross-reference against any available patch level data to determine if the system received February 2026 Patch Tuesday updates addressing CVE-2026-21519.
- Review the triggering process chain: confirm parent-child relationships, capture full command-line arguments, and determine whether the initiating process has a legitimate digital signature from Microsoft or a trusted vendor.
- Examine Windows Event Logs (Security, System, Application) and Sysmon logs on the affected host for the 30-minute window surrounding the alert to identify correlated privilege escalation events (EventID 4672, 4673) or token manipulation (EventID 4624 with elevated token type).
- Query EDR telemetry for any network connections, file writes, or registry modifications made by the suspicious process within 5 minutes of the triggering event to assess post-exploitation activity.
- Check for any newly created scheduled tasks, services, or registry run keys on the affected host that may indicate persistence establishment following successful exploitation.
Containment
- If active exploitation is confirmed, isolate the affected endpoint from the network using EDR network containment or VLAN quarantine to prevent lateral movement while preserving forensic state; do not power off the system.
- Revoke or reset credentials for any accounts that were active on the affected system during the exploitation window, particularly any accounts with elevated privileges, service accounts, or domain admin equivalents.
- Apply the Microsoft security patch for CVE-2026-21519 to all unpatched Windows systems in the environment, prioritizing internet-facing, privileged, and critical infrastructure hosts.
Evidence Collection
- Collect a full memory image of the affected system using an authorized memory acquisition tool (e.g., WinPmem, Magnet RAM Capture) before rebooting; type confusion exploits frequently leave artifacts only in volatile memory.
- Preserve Windows Event Log files (Security.evtx, System.evtx, Application.evtx) and Sysmon logs from the affected host, along with the MFT, Prefetch files, and any relevant ETW traces for offline forensic analysis.
Escalation Criteria
- !Escalate to the incident response team if the suspicious process successfully spawned a privileged shell (e.g., cmd.exe or powershell.exe running as SYSTEM) or if evidence of credential dumping (LSASS memory access, SAM/NTDS.dit reads) is observed.
- !Escalate immediately if the affected host is a domain controller, privileged access workstation, or hosts critical infrastructure services, or if lateral movement indicators are detected from the compromised host to other systems.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security EventID 4672 (Special privileges assigned to new logon) generated when a token with elevated privileges is created following exploitation. - >
Windows Security EventID 4688 with unusual parent-child process relationships, particularly system-protected processes spawning unexpected children. - >
Sysmon EventID 1 (ProcessCreate) entries with suspicious command-line arguments and integrity level elevation (e.g., System integrity from a Medium integrity parent). - >
Sysmon EventID 6 (DriverLoad) entries showing kernel drivers loaded from non-standard paths or by non-system initiating processes. - >
Prefetch files (.pf) for any newly executed processes on the affected system, providing execution history and loaded DLL context. - >
Windows Kernel ETW (Event Tracing for Windows) traces from the Microsoft-Windows-Kernel-Process provider capturing process and thread creation events with full context.
Tuning Guidance
Begin by establishing a baseline of legitimate parent-child process relationships for lsass.exe, winlogon.exe, and csrss.exe in your environment — the expected children are typically conhost.exe and werfault.exe variants only. Whitelist known security software (CrowdStrike, SentinelOne, Microsoft Defender) by their signed process names and certificate hashes for the driver load component. For service installation detections, compile a list of approved software deployment tools and their typical staging paths to reduce false positives from patch management systems. Tune confidence upward if the affected host is unpatched for the February 2026 Patch Tuesday cycle. Consider correlating with vulnerability scanner data to prioritize alerts on hosts confirmed as unpatched for CVE-2026-21519.
Hunting Queries
Threat hunt for anomalous process creation from Windows protected system processes, which may indicate successful type confusion exploitation enabling code execution in the context of privileged system processes.
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("lsass.exe", "winlogon.exe", "csrss.exe", "smss.exe")
| where FileName !in~ ("conhost.exe", "werfault.exe", "WerFaultSecure.exe", "csrss.exe", "smss.exe")
| summarize count(), makeset(FileName), makeset(SHA256), any(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where count_ > 1
| sort by count_ descindex=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage)
| where match(parent, "(lsass\.exe|winlogon\.exe|csrss\.exe|smss\.exe)")
| eval child=lower(Image)
| where NOT match(child, "(conhost\.exe|werfault\.exe|werfaultsecure\.exe)")
| stats count by host, ParentImage, Image, CommandLine
| sort - countThreat hunt for kernel driver loads initiated by processes outside the expected set of trusted Windows system components, which may indicate exploitation of kernel-mode type confusion to load malicious drivers.
DeviceEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "DriverLoad"
| where not(InitiatingProcessFileName in~ ("MsMpEng.exe", "services.exe", "wininit.exe", "TrustedInstaller.exe", "svchost.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| sort by TimeGenerated descindex=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
| where NOT match(lower(Image), "(msmpe ng\.exe|services\.exe|wininit\.exe|trustedinstaller\.exe|svchost\.exe)")
| stats count by host, Image, ImageLoaded, Hashes
| sort - countAtomic Red Team Tests
Simulates a process spawned from winlogon.exe context to test detection of anomalous parent-child relationships indicative of type confusion exploitation. Uses psexec to launch a child process under winlogon's session for lab testing only.
Command
cmd.exe /c echo Simulating anomalous winlogon child process for CVE-2026-21519 detection test > %TEMP%\cve_2026_21519_test.txt && whoami /priv >> %TEMP%\cve_2026_21519_test.txtCleanup
del /f %TEMP%\cve_2026_21519_test.txtExpected Telemetry
Sysmon EventID 1 showing cmd.exe or similar process with an unexpected parent, Windows Security EventID 4688 capturing the new process creation with command line arguments.
Expected Detection
Alert triggered by the KQL and SPL queries on anomalous parent-child process relationship, with medium risk score baseline that should escalate if privilege tokens are observed.
Executes whoami with privilege flags to enumerate token privileges, simulating post-exploitation reconnaissance that would follow a successful type confusion privilege escalation. Detection should fire on the privilege-related command line pattern.
Command
whoami /priv && echo CVE-2026-21519 simulation: token privilege check completeCleanup
No cleanup required; read-only enumeration command.Expected Telemetry
Windows Security EventID 4688 with CommandLine containing privilege-related arguments, Sysmon EventID 1 capturing the full process creation with integrity level.
Expected Detection
Detection queries filtering on privilege-related command line strings should generate an alert with medium confidence; correlate with parent process context for higher fidelity.
Creates and registers a benign service with its executable path pointing to a Temp directory location, simulating the post-exploitation persistence pattern commonly observed after Windows kernel type confusion exploitation.
Command
copy %SystemRoot%\System32\cmd.exe %TEMP%\svc_test_21519.exe && sc create CVE21519TestSvc binPath= "%TEMP%\svc_test_21519.exe" start= demand && sc description CVE21519TestSvc "CVE-2026-21519 detection test service"Cleanup
sc stop CVE21519TestSvc 2>nul; sc delete CVE21519TestSvc 2>nul; del /f %TEMP%\svc_test_21519.exe 2>nulExpected Telemetry
Windows System EventID 7045 (new service installed) with ServiceImagePath pointing to %TEMP%, Sysmon EventID 13 capturing registry writes for the new service key under HKLM\SYSTEM\CurrentControlSet\Services.
Expected Detection
Service installation from temp path detections should fire across KQL, SPL, and QRadar AQL queries with a risk score of 80, triggering medium-confidence alert for analyst review.
Loads a test kernel driver from a non-standard path initiated by a user-mode process to simulate the driver load pattern associated with kernel type confusion exploitation. Requires test-signing mode enabled on lab system.
Command
bcdedit /set testsigning on && echo Driver load simulation requires reboot and a test-signed driver .sys file placed in %TEMP%; consult lab documentation for full atomic test setup. whoami && echo CVE-2026-21519 driver load telemetry test initiatedCleanup
bcdedit /set testsigning offExpected Telemetry
Sysmon EventID 6 (DriverLoad) with the ImageLoaded path pointing to a non-standard location and the initiating process being a user-mode application rather than services.exe or wininit.exe.
Expected Detection
Driver load detection queries should fire with a high risk score (90) due to untrusted initiating process, generating a critical alert requiring immediate triage per playbook.