Detect Microsoft Defender Link Following Privilege Escalation (CVE-2026-41091) in Google Chronicle
Detects exploitation of CVE-2026-41091, a link-following vulnerability (CWE-59) in Microsoft Defender that allows attackers to follow symbolic links or junction points to access or overwrite privileged files. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to privilege escalation or arbitrary file manipulation in the context of the Defender service.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_41091_defender_link_following {
meta:
author = "df00tech Detection Engineering"
description = "Detects exploitation of CVE-2026-41091 Microsoft Defender link-following vulnerability"
severity = "HIGH"
priority = "HIGH"
reference = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091"
events:
(
$e1.metadata.event_type = "PROCESS_LAUNCH"
AND (
re.regex($e1.principal.process.command_line, `(?i)(mklink|junction|symlink)`)
AND re.regex($e1.principal.process.command_line, `(?i)(windows.defender|windefend|msmpeng)`)
)
AND re.regex($e1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|rundll32\.exe)`)
)
OR
(
$e1.metadata.event_type = "FILE_CREATION"
AND re.regex($e1.target.file.full_path, `(?i)(ProgramData\\Microsoft\\Windows Defender|Program Files\\Windows Defender)`)
AND re.regex($e1.principal.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe)`)
)
condition:
$e1
}Chronicle YARA-L rule detecting symlink/junction creation targeting Microsoft Defender paths or suspicious process file creation in Defender directories, indicating CVE-2026-41091 link-following exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Defender exclusion management by IT administrators using command-line tools
- Legitimate junction points created by storage tiering software
- Windows servicing stack operations during major OS updates
- Security product integrations that inspect Defender telemetry directories
Other platforms for CVE-2026-41091
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Symlink Targeting Defender Definitions Directory
Expected signal: Sysmon Event ID 11 with TargetFilename=C:\Users\Public\DefenderLink and Image=cmd.exe; Windows Security Event 4663 if object auditing is enabled for the Defender directory
- Test 2Junction Point Creation via mklink Referencing Defender Support Logs
Expected signal: Process creation event for cmd.exe with CommandLine containing 'mklink /J' and 'Windows Defender'; Sysmon Event ID 1 capturing the full command line
- Test 3PowerShell-Based Symlink Creation Targeting Defender Quarantine
Expected signal: Sysmon Event ID 1 with Image=powershell.exe and CommandLine referencing mklink and Windows Defender Quarantine path; parent-child chain of powershell.exe → cmd.exe visible in process tree
Response Playbook
Triage
- Identify the process and user account that created the symlink or junction pointing into a Microsoft Defender directory — check process lineage to determine if it originated from a user-interactive session or a scheduled task.
- Determine whether Microsoft Defender was actively scanning files at the time of the event, which would indicate the vulnerability was triggered with Defender acting on a maliciously crafted link target.
- Review the target of the symlink or junction to identify what privileged file or directory was being impersonated — assess whether it is a sensitive system path (e.g., SAM, SYSTEM hive, LSA secrets).
- Check the endpoint's current Defender version and patch level against the Microsoft Security Response Center advisory for CVE-2026-41091 to confirm whether the system is running a vulnerable build.
Containment
- Isolate the affected endpoint from the network using your EDR platform (CrowdStrike, Defender for Endpoint) to prevent lateral movement while the investigation is ongoing.
- Remove any symlinks or junction points identified in Defender directories and restore the original directory structure; then force a Defender update to the latest patched version via Windows Update or WSUS/Intune.
Evidence Collection
- Collect the Windows Security Event Log (4656, 4663, 4688) and Sysmon log (Event ID 1, 11) from the affected endpoint covering the 24-hour window around the alert timestamp and preserve as a forensic artefact.
- Capture a memory image of the affected endpoint using a trusted tool (e.g., WinPmem) if active exploitation is suspected, and collect the MpOperationalEvents log from `%ProgramData%\Microsoft\Windows Defender\Support\` for Defender-specific activity.
Escalation Criteria
- !Escalate immediately to incident response if the symlink target resolves to a sensitive credential store (SAM, SYSTEM, SECURITY registry hives, LSASS dump path) or if any new local administrator accounts were created within 15 minutes of the alert.
- !Escalate if the same technique is detected on more than three endpoints in a 60-minute window, indicating automated lateral movement or a worm-like propagation campaign exploiting CVE-2026-41091.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Symbolic link or junction point entries under `%ProgramData%\Microsoft\Windows Defender\` or `%ProgramFiles%\Windows Defender\` visible via `dir /AL` or `fsutil reparsepoint query` - >
Windows Security Event 4663 (Object Access) with Defender service paths and a non-Defender initiating process in the audit log - >
Sysmon Event ID 11 (FileCreate) with `TargetFilename` matching Defender directories initiated by cmd.exe, powershell.exe, or similar - >
Defender operational log at `%ProgramData%\Microsoft\Windows Defender\Support\MPLog-*.log` showing unexpected file access errors or permission-denied events during scans
Tuning Guidance
Begin by establishing a baseline of legitimate Defender self-update and Windows Update processes that touch Defender directories (typically `MpCmdRun.exe`, `MsMpEng.exe`, `TrustedInstaller.exe`, `svchost.exe` under `wuauserv`). Whitelist these parent processes explicitly. Increase confidence to 'high' after baselining once false positive rate drops below 5% over a two-week observation window. For high-value environments, consider tuning the time window down to 2-minute sequences (from 5 minutes) to reduce dwell time between link creation and Defender interaction.
Hunting Queries
Broad 30-day threat hunt for any symlink, junction, or hard link creation events targeting Microsoft Defender directories, intended to surface historical exploitation or reconnaissance that predated alerting coverage.
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in ('SymlinkCreated','JunctionCreated','HardLinkCreated')
| where FolderPath has_any (['\\Windows Defender\\', '\\Windows Defender Advanced Threat Protection\\'])
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| order by Timestamp descindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventID=11
| eval is_defender_path=if(match(TargetFilename, "(?i)(Windows Defender|MsMpEng)"), 1, 0)
| where is_defender_path=1
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as targets by Computer, Image, User
| sort - last_seenAtomic Red Team Tests
Simulates the initial step of CVE-2026-41091 exploitation by creating a directory symlink from a writable user location that points to the Microsoft Defender definitions directory, mimicking an attacker attempting to redirect Defender's file access.
Command
cmd.exe /c mklink /D C:\Users\Public\DefenderLink "C:\ProgramData\Microsoft\Windows Defender\Definition Updates"Cleanup
cmd.exe /c rmdir C:\Users\Public\DefenderLinkExpected Telemetry
Sysmon Event ID 11 with TargetFilename=C:\Users\Public\DefenderLink and Image=cmd.exe; Windows Security Event 4663 if object auditing is enabled for the Defender directory
Expected Detection
CVE-2026-41091 KQL/SPL query triggers on SymlinkCreated action with Defender path reference and cmd.exe as initiating process
Creates an NTFS junction point from a temp directory to the Defender support log directory to simulate an attacker attempting to access privileged Defender diagnostic data via a link-following vulnerability.
Command
cmd.exe /c mklink /J C:\Temp\dflog "C:\ProgramData\Microsoft\Windows Defender\Support"Cleanup
cmd.exe /c rmdir C:\Temp\dflogExpected Telemetry
Process creation event for cmd.exe with CommandLine containing 'mklink /J' and 'Windows Defender'; Sysmon Event ID 1 capturing the full command line
Expected Detection
Chronicle YARAL and Elastic EQL sequence rules fire on the junction creation command matching Defender path patterns
Uses PowerShell to invoke cmd.exe for creating a symbolic link targeting the Defender quarantine directory, replicating a script-based attacker approach that may bypass simple process-name allowlists.
Command
powershell.exe -NoProfile -Command "& cmd.exe /c mklink /D $env:TEMP\QuarantineLink 'C:\ProgramData\Microsoft\Windows Defender\Quarantine'"Cleanup
powershell.exe -Command "Remove-Item -Path $env:TEMP\QuarantineLink -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 1 with Image=powershell.exe and CommandLine referencing mklink and Windows Defender Quarantine path; parent-child chain of powershell.exe → cmd.exe visible in process tree
Expected Detection
CrowdStrike CQL and QRadar AQL rules detect PowerShell parent with mklink CommandLine referencing Defender; Sumo Logic query matches on processname=powershell.exe with defender keyword in command