CVE-2026-33824 — Microsoft IKE Service Extensions Double Free Exploitation

let ikeCrashes = DeviceEvents
| where Timestamp > ago(1d)
| where ActionType in ("ServiceCrashed", "ProcessCrashed", "WerFault")
| where InitiatingProcessFileName =~ "svchost.exe"
| where AdditionalFields has_any ("IKEEXT", "ikeext.dll", "IKE and AuthIP");
let werFaults = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "WerFault.exe"
| where ProcessCommandLine has_any ("IKEEXT", "ikeext", "svchost")
| where ProcessCommandLine has "-p";
union ikeCrashes, werFaults
| project Timestamp, DeviceName, ActionType, FileName, InitiatingProcessFileName, ProcessCommandLine, AdditionalFields
| sort by Timestamp desc

index=windows (source="WinEventLog:System" OR source="WinEventLog:Application")
| eval is_ike=if(match(_raw,"(?i)IKEEXT|ikeext\.dll|IKE and AuthIP"),1,0)
| search (EventCode=7031 OR EventCode=7034 OR EventCode=1000 OR EventCode=1001)
| where is_ike=1
| stats count min(_time) as firstTime max(_time) as lastTime by host, EventCode, Message
| where count >= 1
| convert ctime(firstTime) ctime(lastTime)
| sort - count

sequence by host.name with maxspan=5m
  [ any where event.category == "network" and network.protocol == "isakmp" and destination.port in (500, 4500) and network.direction == "ingress" ]
  [ any where event.category == "process" and (process.name == "WerFault.exe" or event.action == "service-crashed") and process.command_line : ("*IKEEXT*", "*ikeext*", "*svchost*") ]

SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, "Message" FROM events WHERE (destinationport IN (500, 4500) AND LOWER("IPProtocol") = 'udp') OR (LOWER("Message") ILIKE '%ikeext%' OR LOWER("Message") ILIKE '%ike and authip%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=windows/events ("IKEEXT" OR "ikeext.dll" OR "IKE and AuthIP")
| where (EventID = "7031" OR EventID = "7034" OR EventID = "1000" OR EventID = "1001")
| parse "Host=*," as host nodrop
| count by host, EventID
| where _count >= 1
| sort by _count desc

rule cve_2026_33824_ikeext_double_free {
  meta:
    author = "Argus"
    cve = "CVE-2026-33824"
    severity = "HIGH"
    description = "IKEEXT service crash consistent with CVE-2026-33824 double free exploitation"
  events:
    $e.metadata.event_type = "SERVICE_UNKNOWN" or $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.principal.process.command_line, `(?i)ikeext|IKE and AuthIP`) or
      re.regex($e.metadata.description, `(?i)ikeext\.dll|IKEEXT`)
    )
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=/ServiceStopped|ProcessRollup2|WerFaultCrash/
| ServiceName=/IKEEXT/i OR CommandLine=/ikeext/i OR ModuleName=/ikeext\.dll/i
| groupBy([aid, ComputerName, #event_simpleName], function=count(as=hits))
| hits >= 1
| sort(hits, order=desc)