CVE-2026-33824 CrowdStrike LogScale · LogScale

Detect CVE-2026-33824 — Microsoft IKE Service Extensions Double Free Exploitation in CrowdStrike LogScale

Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-33824, a double free (CWE-415) vulnerability in the Microsoft Internet Key Exchange (IKE) Service Extensions (IKEEXT service, ikeext.dll). Successful exploitation via crafted ISAKMP/IKE (UDP 500/4500) traffic can corrupt heap memory and lead to remote code execution or denial of service in the context of the IKEEXT service (LocalSystem). This CVE is on the CISA KEV catalog. Detection focuses on IKEEXT service crashes, anomalous inbound IKE/ISAKMP traffic patterns, WFP/IPsec error bursts, and suspicious child processes or memory-corruption crash telemetry from svchost hosting the IKEEXT service.

MITRE ATT&CK

Tactic
Initial Access Execution Impact

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=/ServiceStopped|ProcessRollup2|WerFaultCrash/
| ServiceName=/IKEEXT/i OR CommandLine=/ikeext/i OR ModuleName=/ikeext\.dll/i
| groupBy([aid, ComputerName, #event_simpleName], function=count(as=hits))
| hits >= 1
| sort(hits, order=desc)
high severity medium confidence

CrowdStrike CQL/LogScale query surfacing IKEEXT service stop, WER crash, and process events tied to CVE-2026-33824 exploitation.

Data Sources

CrowdStrike Falcon EDR

Required Tables

falcon_events

False Positives & Tuning

  • Legitimate IKEEXT restarts during servicing
  • VPN agents restarting the IKE keying module
  • Unrelated svchost crash telemetry

Other platforms for CVE-2026-33824

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate IKEEXT service crash telemetry

    Expected signal: System Event Log 7031/7034 for 'IKE and AuthIP Keying Modules', EDR ServiceStopped event

  2. Test 2Generate inbound ISAKMP/IKE traffic to UDP 500

    Expected signal: Firewall/flow logs showing inbound UDP 500/4500 to the target host

  3. Test 3Trigger WerFault crash-dump generation for svchost

    Expected signal: WerFault.exe process launch with -p targeting the process, WER report queue entry

Last updated: 2026-08-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected host runs an unpatched build of Windows with the IKEEXT (IKE and AuthIP Keying Modules) service enabled and reachable on UDP 500/4500.
  2. Correlate the crash/WerFault event with inbound ISAKMP/IKE traffic in firewall/flow logs immediately preceding the crash to establish a likely exploitation vector.
  3. Review WER crash dumps for svchost hosting IKEEXT for double free / heap corruption signatures (e.g. HEAP_CORRUPTION, second free of the same block) and capture the faulting module (ikeext.dll).
  4. Identify the source IP(s) of the IKE traffic and determine whether they are known VPN peers or untrusted external hosts.

Containment

  1. Block untrusted inbound UDP 500 and 4500 at the perimeter firewall to unaffected/unpatched hosts until the Microsoft security update for CVE-2026-33824 is applied.
  2. Where IPsec/IKE is not required, disable or restrict the IKEEXT service via host firewall rules or Group Policy to remove the attack surface.
  3. Isolate any host showing confirmed exploitation (crash + follow-on suspicious process activity) from the network pending investigation.

Evidence Collection

  1. Preserve WER crash dumps (%LOCALAPPDATA%\CrashDumps and %WINDIR%\Minidump / WER ReportQueue) for the crashing svchost/IKEEXT process.
  2. Export System and Application event logs (Event IDs 7031, 7034, 1000, 1001) and any IPsec/WFP operational logs around the crash window.
  3. Capture full packet capture of inbound UDP 500/4500 from the suspect source IP for malformed ISAKMP payload analysis.
  4. Collect EDR process tree and module-load telemetry for the affected svchost instance.

Escalation Criteria

  • !Escalate to incident response if a crash is followed by anomalous child processes, new service/account creation, or lateral movement from the affected host.
  • !Escalate to threat intel / vendor if crash dumps confirm a controllable double free with evidence of code execution rather than a simple denial of service.
  • !Escalate to CISO/compliance track given CVE-2026-33824's CISA KEV listing and any applicable BOD 26-04 remediation deadline.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >WER crash dumps for svchost hosting IKEEXT with ikeext.dll as faulting module
  • >System Event Log entries 7031/7034 for the IKE and AuthIP Keying Modules service
  • >WFP/IPsec operational event logs showing malformed or aborted IKE_SA negotiations
  • >Firewall/flow records of inbound UDP 500/4500 from the source IP preceding the crash

Tuning Guidance

Baseline normal IKEEXT restart frequency (patch cycles, VPN client behavior) per host class and suppress single expected restarts. Focus alerting on crashes correlated with inbound UDP 500/4500 from non-VPN-peer source IPs, and raise severity when crash dumps show heap-corruption/double-free signatures. Maintain an allowlist of legitimate IKE peers to reduce firewall-flow noise.

Hunting Queries

Hunts for repeated IKEEXT service crashes on the same host within short windows, a hallmark of iterative exploitation attempts against the double free.

Hunting — KQL
kql 
DeviceEvents | where Timestamp > ago(7d) | where AdditionalFields has_any ("IKEEXT","ikeext.dll") | where ActionType in ("ServiceCrashed","WerFault","ProcessCrashed") | summarize crashes=count() by DeviceName, bin(Timestamp, 1h) | where crashes >= 2
Hunting — SPL
spl 
index=windows source="WinEventLog:System" (EventCode=7031 OR EventCode=7034) IKEEXT | bucket _time span=1h | stats count by host, _time | where count>=2

Atomic Red Team Tests

Test 1 Simulate IKEEXT service crash telemetry
windows

Forcibly stops the IKEEXT service in a lab to generate the 7031/7034 service-termination telemetry the detection keys on (does not exploit the vulnerability).

Command

powershell 
sc.exe stop IKEEXT & taskkill /F /FI "SERVICES eq IKEEXT"

Cleanup

powershell 
sc.exe start IKEEXT

Expected Telemetry

System Event Log 7031/7034 for 'IKE and AuthIP Keying Modules', EDR ServiceStopped event

Expected Detection

kql and spl service-crash queries fire on IKEEXT termination

Test 2 Generate inbound ISAKMP/IKE traffic to UDP 500
linux

Sends crafted UDP packets to port 500 to simulate inbound IKE negotiation traffic for the network-correlation logic (lab target only).

Command

bash 
sudo nmap -sU -p 500,4500 --script ike-version <lab_target_ip>

Cleanup

bash 
echo 'no cleanup required; stateless scan'

Expected Telemetry

Firewall/flow logs showing inbound UDP 500/4500 to the target host

Expected Detection

elastic_eql and qradar_aql network-traffic conditions match on inbound ISAKMP

Test 3 Trigger WerFault crash-dump generation for svchost
windows

Creates a WER crash dump for a benign test process standing in for the IKEEXT svchost to validate WerFault-based detection wiring.

Command

powershell 
powershell -c "$p=Start-Process notepad -PassThru; Start-Sleep 2; & \"$env:windir\system32\WerFault.exe\" -u -p $($p.Id)"

Cleanup

powershell 
powershell -c "Get-Process notepad -ErrorAction SilentlyContinue | Stop-Process -Force"

Expected Telemetry

WerFault.exe process launch with -p targeting the process, WER report queue entry

Expected Detection

kql WerFault query and crowdstrike_cql WerFaultCrash condition match

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1499Endpoint Denial of ServiceT1203Exploitation for Client Execution

Same Tactic: Initial Access

Popular Detections