CVE-2026-21525 CrowdStrike LogScale · LogScale

Detect CVE-2026-21525 - Microsoft Windows NULL Pointer Dereference Exploitation in CrowdStrike LogScale

Detects exploitation attempts and post-exploitation activity related to CVE-2026-21525, a NULL pointer dereference vulnerability in Microsoft Windows. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve privilege escalation or code execution via memory corruption techniques targeting Windows kernel or user-mode components.

MITRE ATT&CK

Tactic
Privilege Escalation Defense Evasion Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#repo=base_activities #view=raw
| EventType=ProcessRollup2
| FileName in ("lsass.exe", "svchost.exe", "csrss.exe", "winlogon.exe", "wininit.exe")
| join type=inner (
    #repo=base_activities
    | EventType=SyntheticProcessRollup2
    | ExitCode != 0
    | ExitCode != null
  ) [FileName, aid] by FileName, aid
| union (
    #repo=base_activities
    | EventType=DriverLoaded
    | NOT (DriverCompanyName in ("Microsoft Corporation", "Microsoft Windows"))
    | table aid, ComputerName, DriverFileName, DriverCompanyName, ImageLoadAddress
  )
| eval risk = case(
    ExitCode != 0 and FileName == "lsass.exe", 100,
    ExitCode != 0, 70,
    EventType == "DriverLoaded", 80,
    true, 50)
| where risk >= 50
| table _time, aid, ComputerName, FileName, ExitCode, DriverFileName, DriverCompanyName, risk
| sort -risk -_time
high severity medium confidence

CrowdStrike Falcon CQL detection identifying NULL pointer dereference exploitation via abnormal exits of critical Windows processes and unsigned or third-party driver load events that may indicate kernel-level exploitation.

Data Sources

CrowdStrike Falcon SensorCrowdStrike Process Events

Required Tables

base_activities

False Positives & Tuning

  • Third-party kernel drivers from legitimate security vendors that are not Microsoft-signed
  • System process exits during planned maintenance windows or reboots
  • Development systems where experimental or unsigned drivers are routinely tested

Other platforms for CVE-2026-21525

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Windows Process Crash via WER Trigger

    Expected signal: EventID 1001 in Windows Application Event Log with FaultingApplicationName=CrashTest.exe and ExceptionCode=C0000005; Sysmon EventID 1 for process creation; EDR process termination event with non-zero exit code

  2. Test 2Load Unsigned Test Driver to Simulate Kernel Exploitation Activity

    Expected signal: EventID 7045 in Windows System Event Log with ServiceName=CVE202621525TestDriver and ServiceType=kernel mode driver; Sysmon EventID 12/13 for registry modifications under HKLM\SYSTEM\CurrentControlSet\Services

  3. Test 3LSASS Access Simulation via ProcDump

    Expected signal: Sysmon EventID 10 (ProcessAccess) with TargetImage=lsass.exe and GrantedAccess including 0x1FFFFF or 0x1010; Windows Defender EventID 1121 if credential protection rules are enabled; EDR LSASS access alert

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected Windows host(s) and correlate crash events (EventID 1000/1001) with process names to determine which Windows component is being targeted by the NULL pointer dereference.
  2. Check Windows Error Reporting (WER) logs at %LOCALAPPDATA%\CrashDumps and %WINDIR%\Minidump for crash dump files generated around the alert time — these may contain exploit shellcode artifacts.
  3. Review recently loaded kernel drivers via 'driverquery /v' and cross-reference against EventID 7045 entries to identify any unauthorized or unsigned drivers loaded prior to or after the crash.
  4. Correlate the affected host with recent patch status using 'Get-HotFix' or WSUS/Intune compliance reports to confirm whether February 2026 Patch Tuesday updates (CVE-2026-21525 patch) have been applied.
  5. Examine network connections from the affected process before crash using EDR telemetry to identify potential C2 communications that may indicate successful exploitation and post-exploitation activity.

Containment

  1. Isolate the affected endpoint from the network immediately if active exploitation is confirmed or exploitation evidence is found in crash dumps, to prevent lateral movement or data exfiltration.
  2. Apply the Microsoft security update addressing CVE-2026-21525 to all unpatched Windows systems across the environment as emergency patching, prioritizing internet-facing and high-value systems.
  3. If patching is not immediately possible, consider enabling Windows Defender Exploit Guard or EMET mitigations targeting NULL pointer dereference exploitation techniques as a temporary compensating control.

Evidence Collection

  1. Collect Windows crash dump files from %WINDIR%\Minidump and %LOCALAPPDATA%\CrashDumps, along with WER reports from the Event Log, preserving them for forensic analysis to identify exploit payload characteristics.
  2. Export relevant Windows Event Log entries (Application: 1000/1001, System: 7045/41, Security: 4688/4624) from the affected host covering a 48-hour window around the incident for timeline reconstruction.
  3. Capture a memory image of the affected system using tools like WinPmem or FTK Imager if exploitation is suspected to have succeeded, enabling analysis of in-memory artifacts and injected shellcode.

Escalation Criteria

  • !Escalate immediately to incident response if crash dump analysis reveals shellcode, ROP chains, or exploit artifacts consistent with successful NULL pointer dereference exploitation and privilege escalation.
  • !Escalate if multiple hosts in the environment show similar crash patterns within a short timeframe, indicating a potential mass exploitation campaign or worm-like propagation leveraging CVE-2026-21525.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Windows crash dump files in %WINDIR%\Minidump (kernel mode) and %LOCALAPPDATA%\CrashDumps (user mode) containing call stacks at the point of the NULL pointer dereference
  • >Windows Error Reporting (WER) event entries in the Application Event Log (EventID 1001) with fault module and exception code 0xC0000005 (ACCESS_VIOLATION) or 0xC0000374 (HEAP_CORRUPTION)
  • >Prefetch files for processes that crashed, providing execution timestamps and loaded DLL lists for correlation with known exploit loader patterns
  • >Registry keys under HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps showing configured crash dump paths and retention settings

Tuning Guidance

Reduce false positives by baselining normal crash rates per process in your environment and alerting only on deviations above two standard deviations. Whitelist known-good driver publishers using certificate thumbprints rather than company name strings to avoid bypass. Filter EventID 1001 alerts to focus on processes running at elevated integrity levels (High or System) as these represent higher-risk crash events. Consider adding host asset criticality weighting so the same crash event on a domain controller generates higher priority than on a standard workstation.

Hunting Queries

Threat hunting query to identify hosts with elevated crash rates potentially indicative of repeated exploitation attempts for CVE-2026-21525, correlated with network activity and driver installation events to surface compromised systems

Hunting — KQL
kql 
DeviceEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "ProcessCrashed" or ActionType == "ExploitGuardExploitDetected"
| summarize CrashCount=count(), AffectedProcesses=make_set(FileName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, bin(TimeGenerated, 1h)
| where CrashCount >= 3
| join kind=leftouter (DeviceNetworkEvents | where TimeGenerated >= ago(7d) | summarize NetworkConnections=count() by DeviceName, bin(TimeGenerated, 1h)) on DeviceName, TimeGenerated
| project DeviceName, TimeGenerated, CrashCount, AffectedProcesses, NetworkConnections
| sort by CrashCount desc
Hunting — SPL
spl 
index=windows sourcetype="WinEventLog:Application" EventCode=1001
| bin _time span=1h
| stats count as crash_count, values(ApplicationName) as affected_apps, values(host) as hosts by _time
| where crash_count >= 3
| join type=left _time [
    index=windows sourcetype="WinEventLog:System" EventCode=7045
    | bin _time span=1h
    | stats count as driver_installs, values(ServiceName) as new_drivers by _time
  ]
| table _time, hosts, crash_count, affected_apps, driver_installs, new_drivers
| sort - crash_count

Atomic Red Team Tests

Test 1 Simulate Windows Process Crash via WER Trigger
windows

Triggers a controlled application crash to simulate the Windows Error Reporting events that would be generated during CVE-2026-21525 exploitation, validating detection coverage for EventID 1001 without actual exploitation.

Command

powershell 
# Lab only - creates a controlled crash to test WER detection
$code = @'
using System;
using System.Runtime.InteropServices;
class CrashTest {
    [DllImport("kernel32.dll")] static extern void RaiseException(uint dwExceptionCode, uint dwExceptionFlags, uint nNumberOfArguments, IntPtr lpArguments);
    static void Main() {
        Console.WriteLine("[*] Simulating NULL pointer dereference crash event for detection testing");
        // Trigger access violation (0xC0000005) to simulate NULL ptr deref
        RaiseException(0xC0000005, 0, 0, IntPtr.Zero);
    }
}
'@
$tempDir = "$env:TEMP\\CrashTest"
New-Item -ItemType Directory -Force -Path $tempDir | Out-Null
$csFile = "$tempDir\\CrashTest.cs"
$exeFile = "$tempDir\\CrashTest.exe"
$code | Out-File -FilePath $csFile -Encoding ASCII
csc.exe /out:$exeFile $csFile 2>&1
if (Test-Path $exeFile) {
    Write-Host "[*] Executing crash simulation..."
    & $exeFile
} else {
    Write-Host "[-] Compilation failed - ensure .NET SDK is available"
}

Cleanup

powershell 
Remove-Item -Recurse -Force "$env:TEMP\\CrashTest" -ErrorAction SilentlyContinue

Expected Telemetry

EventID 1001 in Windows Application Event Log with FaultingApplicationName=CrashTest.exe and ExceptionCode=C0000005; Sysmon EventID 1 for process creation; EDR process termination event with non-zero exit code

Expected Detection

Alert triggered by WER crash detection rules monitoring EventID 1001 with access violation exception codes; medium risk score assigned due to non-system-process crash context

Test 2 Load Unsigned Test Driver to Simulate Kernel Exploitation Activity
windows

Attempts to load a test kernel driver to generate EventID 7045 entries simulating the type of driver installation activity that may follow successful kernel NULL pointer dereference exploitation for privilege escalation.

Command

powershell 
# Lab only - requires admin privileges and test signing enabled
# Enable test signing (requires reboot in lab): bcdedit /set testsigning on
# This simulates the driver installation event (EventID 7045) generated post-exploitation

$driverName = "CVE202621525TestDriver"
$driverPath = "$env:SystemRoot\\System32\\drivers\\test_null_deref.sys"

# Create a benign placeholder to simulate the installation event
# In a real exploitation scenario, this would be a malicious driver
Write-Host "[*] Simulating driver service registration (EventID 7045)"
sc.exe create $driverName binPath= $driverPath type= kernel start= demand DisplayName= "CVE-2026-21525 Test Driver" 2>&1
if ($LASTEXITCODE -eq 0) {
    Write-Host "[+] Driver service registration successful - check EventID 7045"
} else {
    Write-Host "[-] Service creation returned: $LASTEXITCODE (expected in lab without actual .sys file)"
}
sc.exe query $driverName 2>&1

Cleanup

powershell 
sc.exe delete CVE202621525TestDriver 2>&1 | Out-Null; Write-Host "[*] Test driver service removed"

Expected Telemetry

EventID 7045 in Windows System Event Log with ServiceName=CVE202621525TestDriver and ServiceType=kernel mode driver; Sysmon EventID 12/13 for registry modifications under HKLM\SYSTEM\CurrentControlSet\Services

Expected Detection

Alert triggered by driver installation detection rule monitoring EventID 7045; high risk score if driver publisher cannot be verified as Microsoft or known security vendor

Test 3 LSASS Access Simulation via ProcDump
windows

Uses the legitimate Sysinternals ProcDump tool to access LSASS memory, simulating the type of LSASS interaction that may occur during post-exploitation of CVE-2026-21525 when an attacker escalates to SYSTEM and attempts credential harvesting.

Command

powershell 
# Lab only - simulates LSASS access event post-exploitation
# Requires admin privileges and ProcDump from Sysinternals
# Download: https://docs.microsoft.com/sysinternals/downloads/procdump

$procDumpPath = "$env:TEMP\\procdump64.exe"
$dumpOutput = "$env:TEMP\\lsass_test_dump.dmp"

if (-not (Test-Path $procDumpPath)) {
    Write-Host "[-] ProcDump not found at $procDumpPath - download from Sysinternals first"
    Write-Host "    Simulating LSASS open handle instead..."
    # Alternative: open a handle to LSASS to trigger Sysmon EventID 10
    $lsassPid = (Get-Process lsass).Id
    $handle = [System.Diagnostics.Process]::GetProcessById($lsassPid)
    Write-Host "[*] Opened handle to LSASS PID: $lsassPid - Sysmon EventID 10 should fire"
    $handle.Dispose()
} else {
    Write-Host "[*] Attempting LSASS memory access via ProcDump"
    & $procDumpPath -accepteula -ma lsass $dumpOutput 2>&1
    Write-Host "[*] Check Sysmon EventID 10 and Windows Defender alerts"
}

Cleanup

powershell 
Remove-Item -Force "$env:TEMP\\lsass_test_dump.dmp" -ErrorAction SilentlyContinue; Write-Host "[*] Cleanup complete"

Expected Telemetry

Sysmon EventID 10 (ProcessAccess) with TargetImage=lsass.exe and GrantedAccess including 0x1FFFFF or 0x1010; Windows Defender EventID 1121 if credential protection rules are enabled; EDR LSASS access alert

Expected Detection

LSASS access detection rules alert on Sysmon EventID 10 targeting lsass.exe; correlated with process crash events from other atomic tests to build higher-confidence exploitation detection chain

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0005Defense EvasionTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1203Exploitation for Client ExecutionT1055Process Injection

Same Tactic: Privilege Escalation

Popular Detections