Microsoft Defender Link Following Privilege Escalation (CVE-2026-41091)

let DefenderPaths = dynamic(['\\ProgramData\\Microsoft\\Windows Defender\\', '\\Program Files\\Windows Defender\\']);
let SuspiciousProcs = dynamic(['cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe']);
union
(
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where InitiatingProcessFileName in~ (SuspiciousProcs)
  | where FolderPath has_any (DefenderPaths)
  | where ActionType in ('FileCreated','FileModified','FileRenamed')
  | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType
),
(
  DeviceEvents
  | where Timestamp > ago(7d)
  | where ActionType == 'SymlinkCreated' or ActionType == 'JunctionCreated'
  | where FolderPath has_any (DefenderPaths)
  | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, ActionType
),
(
  SecurityEvent
  | where TimeGenerated > ago(7d)
  | where EventID in (4656, 4663)
  | where ObjectName has_any (DefenderPaths)
  | where ProcessName has_any (SuspiciousProcs)
  | project TimeGenerated, Computer, SubjectUserName, ProcessName, ObjectName, AccessMask
)
| extend AlertDetail = strcat('Potential CVE-2026-41091 link-following activity targeting Defender path: ', coalesce(FolderPath, ObjectName))
| order by Timestamp desc

index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval defender_path_match=if(match(Object_Name, "(?i)(ProgramData\\\\Microsoft\\\\Windows Defender|Program Files\\\\Windows Defender)") OR match(TargetFilename, "(?i)(ProgramData\\\\Microsoft\\\\Windows Defender|Program Files\\\\Windows Defender)"), 1, 0)
| eval suspicious_proc=if(match(lower(coalesce(Process_Name, Image)), "(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe)"), 1, 0)
| where (EventCode IN (4656, 4663) AND defender_path_match=1 AND suspicious_proc=1)
   OR (EventCode=1 AND suspicious_proc=1 AND defender_path_match=1)
   OR (EventCode=11 AND defender_path_match=1 AND suspicious_proc=1)
   OR (EventCode IN (4688) AND match(CommandLine, "(?i)(mklink|junction|symlink)") AND defender_path_match=1)
| eval alert_detail="CVE-2026-41091: Suspicious link/file op in Defender path by " + coalesce(SubjectUserName, User, "-")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(Object_Name) as target_paths by Computer, SubjectUserName, Process_Name, alert_detail
| where count >= 1
| sort - last_seen

sequence by host.name with maxspan=5m
  [
    process where event.type == "start"
      and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
      and (
        process.command_line like~ "*mklink*"
        or process.command_line like~ "*junction*"
        or process.command_line like~ "*symlink*"
      )
  ]
  [
    file where event.type in ("creation", "change")
      and (
        file.path like~ "*\\ProgramData\\Microsoft\\Windows Defender\\*"
        or file.path like~ "*\\Program Files\\Windows Defender\\*"
      )
  ]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "processname",
  "filename",
  "filepath",
  "commandline",
  CATEGORYNAME(category) AS event_category
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon')
  AND (
    (eventid IN (4656, 4663)
      AND LOWER("filepath") MATCHES '.*\\(programdata\\microsoft\\windows defender|program files\\windows defender).*'
      AND LOWER("processname") MATCHES '.*(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe).*')
    OR
    (eventid IN (1, 4688)
      AND LOWER("commandline") MATCHES '.*(mklink|junction|symlink).*'
      AND LOWER("commandline") MATCHES '.*(windows defender|windefend).*')
  )
  AND DATEFORMAT(devicetime, 'yyyy-MM-dd') >= DATEADD('day', -7, NOW())
ORDER BY devicetime DESC
LIMIT 500

_sourceCategory=Windows/Security OR _sourceCategory=Windows/Sysmon
| where EventID in ("4656", "4663", "1", "4688", "11")
| where (
    (toLowerCase(ObjectName) matches "*programdata\\microsoft\\windows defender*"
     OR toLowerCase(ObjectName) matches "*program files\\windows defender*"
     OR toLowerCase(TargetFilename) matches "*programdata\\microsoft\\windows defender*"
     OR toLowerCase(TargetFilename) matches "*program files\\windows defender*")
    AND (toLowerCase(ProcessName) matches "*cmd.exe*"
         OR toLowerCase(ProcessName) matches "*powershell.exe*"
         OR toLowerCase(ProcessName) matches "*wscript.exe*"
         OR toLowerCase(ProcessName) matches "*rundll32.exe*")
  )
  OR (
    (toLowerCase(CommandLine) matches "*mklink*" OR toLowerCase(CommandLine) matches "*junction*")
    AND (toLowerCase(CommandLine) matches "*defender*" OR toLowerCase(CommandLine) matches "*windefend*")
  )
| fields _messageTime, Computer, SubjectUserName, ProcessName, ObjectName, CommandLine, EventID
| count by Computer, SubjectUserName, ProcessName, EventID
| sort by _count desc

rule cve_2026_41091_defender_link_following {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-41091 Microsoft Defender link-following vulnerability"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091"

  events:
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        re.regex($e1.principal.process.command_line, `(?i)(mklink|junction|symlink)`) 
        AND re.regex($e1.principal.process.command_line, `(?i)(windows.defender|windefend|msmpeng)`)
      )
      AND re.regex($e1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|rundll32\.exe)`)
    )
    OR
    (
      $e1.metadata.event_type = "FILE_CREATION"
      AND re.regex($e1.target.file.full_path, `(?i)(ProgramData\\Microsoft\\Windows Defender|Program Files\\Windows Defender)`)
      AND re.regex($e1.principal.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe)`)
    )

  condition:
    $e1
}

#event_simpleName IN (FileWritten, FileCreated, ProcessRollup2, SyntheticProcessRollup2)
| ParentBaseFileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
  OR ImageFileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| TargetDirectoryName IN ("*\\ProgramData\\Microsoft\\Windows Defender*", "*\\Program Files\\Windows Defender*")
  OR (CommandLine LIKE "%mklink%" AND (CommandLine LIKE "%defender%" OR CommandLine LIKE "%windefend%"))
  OR (CommandLine LIKE "%junction%" AND (CommandLine LIKE "%defender%" OR CommandLine LIKE "%windefend%"))
| eval risk=if(CommandLine LIKE "%mklink%" OR CommandLine LIKE "%junction%", "symlink_creation", "file_write_in_defender_path")
| stats count=count() earliest=min(timestamp) latest=max(timestamp) values(CommandLine) as commands values(TargetDirectoryName) as targets by aid, ComputerName, UserName, ImageFileName, risk
| where count >= 1
| sort - latest