Microsoft Defender Denial of Service Vulnerability (CVE-2026-45498)

let timeframe = 24h;
let DefenderServiceEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType in ("ServiceStopped", "ServiceCrashed", "AntivirusDisabled")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MpCmdRun.exe", "SecurityHealthService.exe", "WinDefend.exe")
| project Timestamp, DeviceName, DeviceId, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessId, ReportId;
let DefenderHealthEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType == "AntivirusDisabled" or ActionType == "AntivirusScanFailed"
| project Timestamp, DeviceName, DeviceId, ActionType, AdditionalFields, ReportId;
let ServiceCrashEvents = DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where FileName =~ "MsMpEng.exe"
| where ActionType == "ProcessCreated"
| summarize RestartCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, DeviceId, bin(Timestamp, 1h)
| where RestartCount >= 3
| extend AlertReason = "Defender process restarted 3+ times within 1 hour";
DefenderServiceEvents
| union DefenderHealthEvents
| union (ServiceCrashEvents | project Timestamp = LastSeen, DeviceName, DeviceId, ActionType = "FrequentDefenderRestart", AlertReason)
| sort by Timestamp desc

index=wineventlog OR index=sysmon sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational", "WinEventLog:System", "xmlwineventlog")
| eval EventID=coalesce(EventID, event_id)
| where (sourcetype="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational" AND EventID IN (5001, 5007, 5010, 5012, 1116, 1117, 2004))
  OR (sourcetype="WinEventLog:System" AND EventID=7034 AND Message LIKE "%Windows Defender%")
  OR (sourcetype="WinEventLog:System" AND EventID=7031 AND Message LIKE "%Windows Defender%")
| eval alert_category=case(
    EventID=5001, "Defender Real-Time Protection Disabled",
    EventID=5007, "Defender Configuration Changed",
    EventID=5010, "Defender Scanning Disabled",
    EventID=5012, "Defender On-Access Scans Disabled",
    EventID IN (1116, 1117), "Defender Malware Detection",
    EventID=2004, "Defender Real-Time Protection Suspended",
    EventID=7034, "Defender Service Crashed",
    EventID=7031, "Defender Service Failed Unexpectedly",
    true(), "Other Defender Event"
  )
| stats count AS event_count, values(alert_category) AS categories, min(_time) AS first_seen, max(_time) AS last_seen by host, ComputerName
| where event_count >= 2
| eval duration_secs = last_seen - first_seen
| where duration_secs <= 3600
| sort -event_count

sequence by host.name with maxspan=1h
  [process where event.action == "start" and process.name : "MsMpEng.exe"] by host.name
  [process where event.action == "stop" and process.name : "MsMpEng.exe"] by host.name
  [process where event.action == "start" and process.name : "MsMpEng.exe"] by host.name
| head 100

/* Alternative: service crash and restart pattern */
/* 
any where
  (
    (event.provider == "Microsoft-Windows-Windows Defender" and event.code in ("5001", "5007", "5010", "5012", "2004"))
    or
    (event.provider == "Service Control Manager" and event.code in ("7034", "7031") and message : "*Defender*")
  )
  and not user.name : ("SYSTEM", "NT AUTHORITY\\SYSTEM")
*/

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip",
  "destinationip",
  username,
  QIDNAME(qid) AS event_name,
  eventcount,
  CATEGORYNAME(category) AS category_name,
  "devicehostname"
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Windows%'
  AND (
    (QIDNAME(qid) ILIKE '%Defender%' AND (QIDNAME(qid) ILIKE '%disabled%' OR QIDNAME(qid) ILIKE '%stopped%' OR QIDNAME(qid) ILIKE '%crashed%' OR QIDNAME(qid) ILIKE '%failed%'))
    OR ("EventID" IN ('5001', '5007', '5010', '5012', '2004', '7034', '7031') AND QIDNAME(qid) ILIKE '%Defender%')
  )
  AND LOGSOURCETYPENAME(logsourceid) NOT ILIKE '%firewall%'
  AND starttime > NOW() - 86400 SECONDS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/events OR _sourceCategory=endpoint/defender
| where _sourceName matches "*Windows Defender*" OR _sourceName matches "*Microsoft-Windows-Windows Defender*"
| json auto
| where EventID in ("5001", "5007", "5010", "5012", "2004", "7034", "7031") or (message contains "Defender" and (message contains "stopped" or message contains "disabled" or message contains "crashed" or message contains "failed"))
| eval severity_level = if(EventID in ("5001", "5010", "5012", "7034", "7031"), "HIGH", "MEDIUM")
| timeslice 15m
| stats count as event_count, values(EventID) as event_ids, values(message) as messages by _timeslice, Computer, severity_level
| where event_count >= 1
| sort by _timeslice desc

rule cve_2026_45498_defender_dos {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Microsoft Defender DoS exploitation (CVE-2026-45498) via service disruption events"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498"
    cve = "CVE-2026-45498"

  events:
    (
      $e.metadata.event_type = "STATUS_UPDATE"
      AND (
        (
          $e.metadata.product_name = "Windows Defender"
          AND (
            $e.metadata.product_event_type = "5001"
            OR $e.metadata.product_event_type = "5007"
            OR $e.metadata.product_event_type = "5010"
            OR $e.metadata.product_event_type = "5012"
            OR $e.metadata.product_event_type = "2004"
          )
        )
        OR (
          $e.metadata.product_event_type = "7034"
          AND re.regex($e.target.application, `(?i)defender`)
        )
        OR (
          $e.metadata.product_event_type = "7031"
          AND re.regex($e.target.application, `(?i)defender`)
        )
      )
    )
    $e.principal.hostname = $hostname

  match:
    $hostname over 1h

  condition:
    #e >= 2
}

#event_simpleName IN ("ProcessRollup2", "ServiceStarted", "ServiceStopped")
| filter ImageFileName CONTAINS "MsMpEng" OR ServiceDisplayName CONTAINS "Defender" OR ServiceDisplayName CONTAINS "Windows Defender"
| eval event_type=case(
    event_simpleName="ProcessRollup2" AND ImageFileName CONTAINS "MsMpEng", "DefenderProcessEvent",
    event_simpleName="ServiceStopped" AND ServiceDisplayName CONTAINS "Defender", "DefenderServiceStopped",
    event_simpleName="ServiceStarted" AND ServiceDisplayName CONTAINS "Defender", "DefenderServiceStarted",
    true(), "Other"
  )
| stats count() AS event_count, dc(event_simpleName) AS event_type_variety, min(timestamp) AS first_event, max(timestamp) AS last_event BY aid, ComputerName, event_type
| where event_count >= 3 AND event_type_variety >= 2
| eval time_window_secs = last_event - first_event
| where time_window_secs <= 3600
| sort -event_count