Detect CVE-2026-21525 - Microsoft Windows NULL Pointer Dereference Exploitation in Google Chronicle
Detects exploitation attempts and post-exploitation activity related to CVE-2026-21525, a NULL pointer dereference vulnerability in Microsoft Windows. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve privilege escalation or code execution via memory corruption techniques targeting Windows kernel or user-mode components.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_21525_null_ptr_deref {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2026-21525 Windows NULL pointer dereference exploitation via process crashes and driver events"
severity = "HIGH"
priority = "HIGH"
reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"
events:
(
$event.metadata.event_type = "PROCESS_UNCATEGORIZED"
and $event.principal.process.file.full_path = /(?i)(lsass|svchost|csrss|winlogon|wininit)\.exe$/
and $event.principal.process.pid != null
) or (
$event.metadata.product_event_type = "7045"
and $event.principal.hostname != ""
) or (
$event.metadata.product_event_type = "1001"
and $event.about.labels.key = "FaultingApplicationName"
and $event.about.labels.value = /(?i)(lsass|svchost|csrss)/
)
condition:
$event
}Chronicle YARA-L rule detecting NULL pointer dereference exploitation indicators targeting Windows system processes, including crash events for high-value processes and suspicious kernel driver installations.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate crashes of Windows system processes due to hardware memory issues
- Windows Feature Updates installing new kernel-mode drivers
- Third-party security software injecting into system processes for monitoring
Other platforms for CVE-2026-21525
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Windows Process Crash via WER Trigger
Expected signal: EventID 1001 in Windows Application Event Log with FaultingApplicationName=CrashTest.exe and ExceptionCode=C0000005; Sysmon EventID 1 for process creation; EDR process termination event with non-zero exit code
- Test 2Load Unsigned Test Driver to Simulate Kernel Exploitation Activity
Expected signal: EventID 7045 in Windows System Event Log with ServiceName=CVE202621525TestDriver and ServiceType=kernel mode driver; Sysmon EventID 12/13 for registry modifications under HKLM\SYSTEM\CurrentControlSet\Services
- Test 3LSASS Access Simulation via ProcDump
Expected signal: Sysmon EventID 10 (ProcessAccess) with TargetImage=lsass.exe and GrantedAccess including 0x1FFFFF or 0x1010; Windows Defender EventID 1121 if credential protection rules are enabled; EDR LSASS access alert
Response Playbook
Triage
- Identify the affected Windows host(s) and correlate crash events (EventID 1000/1001) with process names to determine which Windows component is being targeted by the NULL pointer dereference.
- Check Windows Error Reporting (WER) logs at %LOCALAPPDATA%\CrashDumps and %WINDIR%\Minidump for crash dump files generated around the alert time — these may contain exploit shellcode artifacts.
- Review recently loaded kernel drivers via 'driverquery /v' and cross-reference against EventID 7045 entries to identify any unauthorized or unsigned drivers loaded prior to or after the crash.
- Correlate the affected host with recent patch status using 'Get-HotFix' or WSUS/Intune compliance reports to confirm whether February 2026 Patch Tuesday updates (CVE-2026-21525 patch) have been applied.
- Examine network connections from the affected process before crash using EDR telemetry to identify potential C2 communications that may indicate successful exploitation and post-exploitation activity.
Containment
- Isolate the affected endpoint from the network immediately if active exploitation is confirmed or exploitation evidence is found in crash dumps, to prevent lateral movement or data exfiltration.
- Apply the Microsoft security update addressing CVE-2026-21525 to all unpatched Windows systems across the environment as emergency patching, prioritizing internet-facing and high-value systems.
- If patching is not immediately possible, consider enabling Windows Defender Exploit Guard or EMET mitigations targeting NULL pointer dereference exploitation techniques as a temporary compensating control.
Evidence Collection
- Collect Windows crash dump files from %WINDIR%\Minidump and %LOCALAPPDATA%\CrashDumps, along with WER reports from the Event Log, preserving them for forensic analysis to identify exploit payload characteristics.
- Export relevant Windows Event Log entries (Application: 1000/1001, System: 7045/41, Security: 4688/4624) from the affected host covering a 48-hour window around the incident for timeline reconstruction.
- Capture a memory image of the affected system using tools like WinPmem or FTK Imager if exploitation is suspected to have succeeded, enabling analysis of in-memory artifacts and injected shellcode.
Escalation Criteria
- !Escalate immediately to incident response if crash dump analysis reveals shellcode, ROP chains, or exploit artifacts consistent with successful NULL pointer dereference exploitation and privilege escalation.
- !Escalate if multiple hosts in the environment show similar crash patterns within a short timeframe, indicating a potential mass exploitation campaign or worm-like propagation leveraging CVE-2026-21525.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows crash dump files in %WINDIR%\Minidump (kernel mode) and %LOCALAPPDATA%\CrashDumps (user mode) containing call stacks at the point of the NULL pointer dereference - >
Windows Error Reporting (WER) event entries in the Application Event Log (EventID 1001) with fault module and exception code 0xC0000005 (ACCESS_VIOLATION) or 0xC0000374 (HEAP_CORRUPTION) - >
Prefetch files for processes that crashed, providing execution timestamps and loaded DLL lists for correlation with known exploit loader patterns - >
Registry keys under HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps showing configured crash dump paths and retention settings
Tuning Guidance
Reduce false positives by baselining normal crash rates per process in your environment and alerting only on deviations above two standard deviations. Whitelist known-good driver publishers using certificate thumbprints rather than company name strings to avoid bypass. Filter EventID 1001 alerts to focus on processes running at elevated integrity levels (High or System) as these represent higher-risk crash events. Consider adding host asset criticality weighting so the same crash event on a domain controller generates higher priority than on a standard workstation.
Hunting Queries
Threat hunting query to identify hosts with elevated crash rates potentially indicative of repeated exploitation attempts for CVE-2026-21525, correlated with network activity and driver installation events to surface compromised systems
DeviceEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "ProcessCrashed" or ActionType == "ExploitGuardExploitDetected"
| summarize CrashCount=count(), AffectedProcesses=make_set(FileName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, bin(TimeGenerated, 1h)
| where CrashCount >= 3
| join kind=leftouter (DeviceNetworkEvents | where TimeGenerated >= ago(7d) | summarize NetworkConnections=count() by DeviceName, bin(TimeGenerated, 1h)) on DeviceName, TimeGenerated
| project DeviceName, TimeGenerated, CrashCount, AffectedProcesses, NetworkConnections
| sort by CrashCount descindex=windows sourcetype="WinEventLog:Application" EventCode=1001
| bin _time span=1h
| stats count as crash_count, values(ApplicationName) as affected_apps, values(host) as hosts by _time
| where crash_count >= 3
| join type=left _time [
index=windows sourcetype="WinEventLog:System" EventCode=7045
| bin _time span=1h
| stats count as driver_installs, values(ServiceName) as new_drivers by _time
]
| table _time, hosts, crash_count, affected_apps, driver_installs, new_drivers
| sort - crash_countAtomic Red Team Tests
Triggers a controlled application crash to simulate the Windows Error Reporting events that would be generated during CVE-2026-21525 exploitation, validating detection coverage for EventID 1001 without actual exploitation.
Command
# Lab only - creates a controlled crash to test WER detection
$code = @'
using System;
using System.Runtime.InteropServices;
class CrashTest {
[DllImport("kernel32.dll")] static extern void RaiseException(uint dwExceptionCode, uint dwExceptionFlags, uint nNumberOfArguments, IntPtr lpArguments);
static void Main() {
Console.WriteLine("[*] Simulating NULL pointer dereference crash event for detection testing");
// Trigger access violation (0xC0000005) to simulate NULL ptr deref
RaiseException(0xC0000005, 0, 0, IntPtr.Zero);
}
}
'@
$tempDir = "$env:TEMP\\CrashTest"
New-Item -ItemType Directory -Force -Path $tempDir | Out-Null
$csFile = "$tempDir\\CrashTest.cs"
$exeFile = "$tempDir\\CrashTest.exe"
$code | Out-File -FilePath $csFile -Encoding ASCII
csc.exe /out:$exeFile $csFile 2>&1
if (Test-Path $exeFile) {
Write-Host "[*] Executing crash simulation..."
& $exeFile
} else {
Write-Host "[-] Compilation failed - ensure .NET SDK is available"
}Cleanup
Remove-Item -Recurse -Force "$env:TEMP\\CrashTest" -ErrorAction SilentlyContinueExpected Telemetry
EventID 1001 in Windows Application Event Log with FaultingApplicationName=CrashTest.exe and ExceptionCode=C0000005; Sysmon EventID 1 for process creation; EDR process termination event with non-zero exit code
Expected Detection
Alert triggered by WER crash detection rules monitoring EventID 1001 with access violation exception codes; medium risk score assigned due to non-system-process crash context
Attempts to load a test kernel driver to generate EventID 7045 entries simulating the type of driver installation activity that may follow successful kernel NULL pointer dereference exploitation for privilege escalation.
Command
# Lab only - requires admin privileges and test signing enabled
# Enable test signing (requires reboot in lab): bcdedit /set testsigning on
# This simulates the driver installation event (EventID 7045) generated post-exploitation
$driverName = "CVE202621525TestDriver"
$driverPath = "$env:SystemRoot\\System32\\drivers\\test_null_deref.sys"
# Create a benign placeholder to simulate the installation event
# In a real exploitation scenario, this would be a malicious driver
Write-Host "[*] Simulating driver service registration (EventID 7045)"
sc.exe create $driverName binPath= $driverPath type= kernel start= demand DisplayName= "CVE-2026-21525 Test Driver" 2>&1
if ($LASTEXITCODE -eq 0) {
Write-Host "[+] Driver service registration successful - check EventID 7045"
} else {
Write-Host "[-] Service creation returned: $LASTEXITCODE (expected in lab without actual .sys file)"
}
sc.exe query $driverName 2>&1Cleanup
sc.exe delete CVE202621525TestDriver 2>&1 | Out-Null; Write-Host "[*] Test driver service removed"Expected Telemetry
EventID 7045 in Windows System Event Log with ServiceName=CVE202621525TestDriver and ServiceType=kernel mode driver; Sysmon EventID 12/13 for registry modifications under HKLM\SYSTEM\CurrentControlSet\Services
Expected Detection
Alert triggered by driver installation detection rule monitoring EventID 7045; high risk score if driver publisher cannot be verified as Microsoft or known security vendor
Uses the legitimate Sysinternals ProcDump tool to access LSASS memory, simulating the type of LSASS interaction that may occur during post-exploitation of CVE-2026-21525 when an attacker escalates to SYSTEM and attempts credential harvesting.
Command
# Lab only - simulates LSASS access event post-exploitation
# Requires admin privileges and ProcDump from Sysinternals
# Download: https://docs.microsoft.com/sysinternals/downloads/procdump
$procDumpPath = "$env:TEMP\\procdump64.exe"
$dumpOutput = "$env:TEMP\\lsass_test_dump.dmp"
if (-not (Test-Path $procDumpPath)) {
Write-Host "[-] ProcDump not found at $procDumpPath - download from Sysinternals first"
Write-Host " Simulating LSASS open handle instead..."
# Alternative: open a handle to LSASS to trigger Sysmon EventID 10
$lsassPid = (Get-Process lsass).Id
$handle = [System.Diagnostics.Process]::GetProcessById($lsassPid)
Write-Host "[*] Opened handle to LSASS PID: $lsassPid - Sysmon EventID 10 should fire"
$handle.Dispose()
} else {
Write-Host "[*] Attempting LSASS memory access via ProcDump"
& $procDumpPath -accepteula -ma lsass $dumpOutput 2>&1
Write-Host "[*] Check Sysmon EventID 10 and Windows Defender alerts"
}Cleanup
Remove-Item -Force "$env:TEMP\\lsass_test_dump.dmp" -ErrorAction SilentlyContinue; Write-Host "[*] Cleanup complete"Expected Telemetry
Sysmon EventID 10 (ProcessAccess) with TargetImage=lsass.exe and GrantedAccess including 0x1FFFFF or 0x1010; Windows Defender EventID 1121 if credential protection rules are enabled; EDR LSASS access alert
Expected Detection
LSASS access detection rules alert on Sysmon EventID 10 targeting lsass.exe; correlated with process crash events from other atomic tests to build higher-confidence exploitation detection chain