Detect Microsoft Defender Link Following Privilege Escalation (CVE-2026-41091) in Microsoft Sentinel
Detects exploitation of CVE-2026-41091, a link-following vulnerability (CWE-59) in Microsoft Defender that allows attackers to follow symbolic links or junction points to access or overwrite privileged files. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to privilege escalation or arbitrary file manipulation in the context of the Defender service.
MITRE ATT&CK
KQL Detection Query
let DefenderPaths = dynamic(['\\ProgramData\\Microsoft\\Windows Defender\\', '\\Program Files\\Windows Defender\\']);
let SuspiciousProcs = dynamic(['cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe']);
union
(
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (SuspiciousProcs)
| where FolderPath has_any (DefenderPaths)
| where ActionType in ('FileCreated','FileModified','FileRenamed')
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType
),
(
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == 'SymlinkCreated' or ActionType == 'JunctionCreated'
| where FolderPath has_any (DefenderPaths)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, ActionType
),
(
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4656, 4663)
| where ObjectName has_any (DefenderPaths)
| where ProcessName has_any (SuspiciousProcs)
| project TimeGenerated, Computer, SubjectUserName, ProcessName, ObjectName, AccessMask
)
| extend AlertDetail = strcat('Potential CVE-2026-41091 link-following activity targeting Defender path: ', coalesce(FolderPath, ObjectName))
| order by Timestamp descDetects symlink/junction creation and suspicious file operations targeting Microsoft Defender directories, indicative of CVE-2026-41091 link-following exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Defender update processes writing to Defender directories
- Antivirus remediation tasks accessing ProgramData\Windows Defender paths
- System administrators using junction points for storage management
- Backup software traversing Defender directories during scheduled scans
Other platforms for CVE-2026-41091
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Symlink Targeting Defender Definitions Directory
Expected signal: Sysmon Event ID 11 with TargetFilename=C:\Users\Public\DefenderLink and Image=cmd.exe; Windows Security Event 4663 if object auditing is enabled for the Defender directory
- Test 2Junction Point Creation via mklink Referencing Defender Support Logs
Expected signal: Process creation event for cmd.exe with CommandLine containing 'mklink /J' and 'Windows Defender'; Sysmon Event ID 1 capturing the full command line
- Test 3PowerShell-Based Symlink Creation Targeting Defender Quarantine
Expected signal: Sysmon Event ID 1 with Image=powershell.exe and CommandLine referencing mklink and Windows Defender Quarantine path; parent-child chain of powershell.exe → cmd.exe visible in process tree
Unlock Pro Content
Get the full detection package for CVE-2026-41091 including response playbook, investigation guide, and atomic red team tests.