CVE-2026-45498 Microsoft Sentinel · KQL

Detect Microsoft Defender Denial of Service Vulnerability (CVE-2026-45498) in Microsoft Sentinel

CVE-2026-45498 is a Denial of Service vulnerability in Microsoft Defender. Exploitation can cause Defender to crash, hang, or become unresponsive, effectively disabling endpoint protection on affected hosts. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may leverage this to disable security tooling prior to follow-on intrusion activity.

MITRE ATT&CK

Tactic
Defense Evasion Impact

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let timeframe = 24h;
let DefenderServiceEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType in ("ServiceStopped", "ServiceCrashed", "AntivirusDisabled")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MpCmdRun.exe", "SecurityHealthService.exe", "WinDefend.exe")
| project Timestamp, DeviceName, DeviceId, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessId, ReportId;
let DefenderHealthEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType == "AntivirusDisabled" or ActionType == "AntivirusScanFailed"
| project Timestamp, DeviceName, DeviceId, ActionType, AdditionalFields, ReportId;
let ServiceCrashEvents = DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where FileName =~ "MsMpEng.exe"
| where ActionType == "ProcessCreated"
| summarize RestartCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, DeviceId, bin(Timestamp, 1h)
| where RestartCount >= 3
| extend AlertReason = "Defender process restarted 3+ times within 1 hour";
DefenderServiceEvents
| union DefenderHealthEvents
| union (ServiceCrashEvents | project Timestamp = LastSeen, DeviceName, DeviceId, ActionType = "FrequentDefenderRestart", AlertReason)
| sort by Timestamp desc
high severity medium confidence

Detects Microsoft Defender service crashes, unexpected disabling, and frequent restarts that may indicate exploitation of CVE-2026-45498. Monitors for Defender process anomalies, service state changes, and antivirus health events across DeviceEvents and DeviceProcessEvents tables.

Data Sources

Microsoft Defender for EndpointMicrosoft SentinelAzure Monitor

Required Tables

DeviceEventsDeviceProcessEvents

False Positives & Tuning

  • Legitimate administrative disabling of Defender during maintenance windows
  • Windows updates or patches that temporarily stop and restart Defender services
  • Third-party security product installation that temporarily disables Defender
  • Automated patch management tools that restart security services
  • System resource exhaustion causing unrelated process crashes

Other platforms for CVE-2026-45498

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Defender Real-Time Protection Disable Event

    Expected signal: Windows Defender Operational EventID 5001 (disabled) followed by EventID 5000 (enabled); DeviceEvents ActionType AntivirusDisabled in MDE telemetry

  2. Test 2Force MsMpEng Process Restart Sequence

    Expected signal: System EventLog EventIDs 7036 (service state changed), 7034 (if crash simulated) for WinDefend service; multiple MsMpEng.exe process start events in DeviceProcessEvents

  3. Test 3Defender Configuration Tampering via Registry

    Expected signal: Windows Defender Operational EventID 5007 (configuration changed); registry modification event in DeviceRegistryEvents for HKLM\SOFTWARE\Policies\Microsoft\Windows Defender

  4. Test 4Generate Windows Error Reporting Artifact for MsMpEng

    Expected signal: Process access event against MsMpEng.exe in DeviceEvents (ActionType OpenProcess); file creation event for .dmp file; procdump.exe process creation with MsMpEng PID as argument

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host(s) by correlating Defender service disruption events (EventIDs 5001, 5007, 5010, 5012, 2004, 7034, 7031) with device inventory to confirm Microsoft Defender is installed and determine patch level.
  2. Check the Windows Defender Operational log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational) on the affected host for the exact error codes, timestamps, and any associated process names that triggered the service disruption.
  3. Determine whether the Defender disruption is isolated to a single endpoint or is occurring across multiple systems, which would suggest coordinated or automated exploitation.
  4. Review process creation events around the time of the Defender crash to identify any suspicious parent-child process relationships, unusual command-line arguments, or processes associated with known exploit payloads.
  5. Check whether any other security controls (EDR agents, host-based firewalls) were also disrupted concurrently, which may indicate a broader defense evasion campaign leveraging CVE-2026-45498.

Containment

  1. Isolate the affected endpoint(s) from the network using EDR network isolation or equivalent capability to prevent lateral movement while Defender is in a degraded or disabled state.
  2. Deploy an alternative endpoint protection solution or enable Windows Firewall with strict rules as a compensating control until Defender can be patched and restored to full functionality.
  3. Apply the Microsoft security update addressing CVE-2026-45498 to affected systems; reference the MSRC advisory at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 for the applicable KB article.

Evidence Collection

  1. Collect the Windows Defender Operational event log (wevtutil epl 'Microsoft-Windows-Windows Defender/Operational' defender_operational.evtx) and System event log from the affected host for forensic analysis.
  2. Capture a memory dump of the MsMpEng.exe process (if still running in a degraded state) and any suspicious processes active at the time of the crash using tools such as ProcDump or Task Manager for offline analysis.
  3. Export prefetch files, Windows Event Logs (Security, System, Application), and recent PowerShell ScriptBlock logs to identify what process or activity preceded the Defender crash.

Escalation Criteria

  • !Escalate to incident response if the Defender service disruption is accompanied by evidence of follow-on malicious activity such as new process injection, credential access, lateral movement, or data staging — indicating the DoS was used as a precursor to deeper compromise.
  • !Escalate if five or more distinct hosts show Defender disruptions within a 24-hour period, suggesting active exploitation at scale or a worm-like propagation pattern.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Windows Defender Operational event log entries with EventIDs 5001 (real-time protection disabled), 5007 (configuration changed), 5010 (scanning disabled), 5012 (on-access scans disabled), 2004 (real-time protection suspended)
  • >Windows System event log entries with EventID 7034 (service crashed unexpectedly) or 7031 (service terminated unexpectedly) referencing 'Windows Defender' or 'WinDefend'
  • >MsMpEng.exe crash dump files located at %ProgramData%\Microsoft\Windows Defender\Support\ or in Windows Error Reporting queues (%LOCALAPPDATA%\CrashDumps)
  • >Windows Error Reporting (WER) entries in the Application event log (EventID 1000/1001) referencing MsMpEng.exe faulting module
  • >Prefetch files for any processes active immediately before the Defender crash at C:\Windows\Prefetch\

Tuning Guidance

This detection will generate false positives in environments that regularly patch Windows (Defender restarts during updates) or use Group Policy/MDM to manage Defender settings. Tune by adding exclusions for known patch maintenance windows and authorized administrative accounts that routinely modify Defender configuration. In environments where CrowdStrike Falcon or another primary EDR is deployed alongside Defender, sensor interaction events may trigger this rule — add the EDR service account and process names to exclusion lists. Raise the event count threshold (e.g., from 2 to 5 events within 1 hour) in high-volatility environments to reduce noise while maintaining detection of sustained exploitation attempts. For high-confidence alerting, correlate Defender disruption events with subsequent suspicious process creation (non-standard parent processes, encoded PowerShell, LOLBins) to filter to true exploitation scenarios.

Hunting Queries

Hunt for anomalous Defender disable and scan failure events across the environment over the past 7 days to identify hosts potentially targeted by CVE-2026-45498 exploitation. Looks for non-standard processes initiating Defender state changes and clusters of events suggesting active exploitation.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "AntivirusDisabled" or ActionType == "AntivirusScanFailed" or ActionType == "ServiceStopped"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MpCmdRun.exe", "svchost.exe", "TrustedInstaller.exe", "wuauclt.exe")
| summarize DisableCount = count(), UniqueProcesses = dcount(InitiatingProcessFileName), Processes = make_set(InitiatingProcessFileName), CommandLines = make_set(InitiatingProcessCommandLine) by DeviceName, DeviceId, bin(Timestamp, 1h)
| where DisableCount >= 2
| sort by DisableCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational"
| where EventID IN (5001, 5010, 5012, 2004)
| stats count AS disable_events, dc(host) AS unique_hosts, values(host) AS affected_hosts by _time span=1h
| where disable_events >= 3 OR unique_hosts >= 3
| sort -disable_events

Atomic Red Team Tests

Test 1 Simulate Defender Real-Time Protection Disable Event
windows

Disables and re-enables Windows Defender real-time protection to generate EventID 5001 in the Windows Defender Operational log, simulating the type of telemetry produced during CVE-2026-45498 exploitation.

Command

powershell 
# Run as Administrator in isolated lab VM only
Set-MpPreference -DisableRealtimeMonitoring $true
Start-Sleep -Seconds 5
Set-MpPreference -DisableRealtimeMonitoring $false

Cleanup

powershell 
Set-MpPreference -DisableRealtimeMonitoring $false

Expected Telemetry

Windows Defender Operational EventID 5001 (disabled) followed by EventID 5000 (enabled); DeviceEvents ActionType AntivirusDisabled in MDE telemetry

Expected Detection

Detection should fire on the AntivirusDisabled event with InitiatingProcessFileName 'powershell.exe', which is not in the standard exclusion list for Defender management processes

Test 2 Force MsMpEng Process Restart Sequence
windows

Stops and restarts the Windows Defender service three times within a short window to simulate the rapid restart pattern indicative of a DoS crash loop triggered by CVE-2026-45498.

Command

powershell 
# Run as Administrator in isolated lab VM only
For ($i=0; $i -lt 3; $i++) {
  Stop-Service -Name WinDefend -Force -ErrorAction SilentlyContinue
  Start-Sleep -Seconds 3
  Start-Service -Name WinDefend -ErrorAction SilentlyContinue
  Start-Sleep -Seconds 5
}
Get-Service WinDefend

Cleanup

powershell 
Start-Service -Name WinDefend; Set-Service -Name WinDefend -StartupType Automatic

Expected Telemetry

System EventLog EventIDs 7036 (service state changed), 7034 (if crash simulated) for WinDefend service; multiple MsMpEng.exe process start events in DeviceProcessEvents

Expected Detection

KQL detection triggers on 3+ MsMpEng.exe restart events within 1 hour; SPL correlation detects multiple service state change events from the same host

Test 3 Defender Configuration Tampering via Registry
windows

Modifies Windows Defender registry keys to simulate configuration tampering that triggers EventID 5007, representing the kind of state change an attacker might induce when exploiting CVE-2026-45498 to destabilize Defender.

Command

powershell 
# Run as Administrator in isolated lab VM only — restore immediately after test
$regPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
If (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force }
Set-ItemProperty -Path $regPath -Name 'DisableAntiSpyware' -Value 1 -Type DWord
Start-Sleep -Seconds 5
Remove-ItemProperty -Path $regPath -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue

Cleanup

powershell 
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -ErrorAction SilentlyContinue; gpupdate /force

Expected Telemetry

Windows Defender Operational EventID 5007 (configuration changed); registry modification event in DeviceRegistryEvents for HKLM\SOFTWARE\Policies\Microsoft\Windows Defender

Expected Detection

Registry modification to Defender policy keys should appear in DeviceRegistryEvents; paired with Defender Operational EventID 5007, this combination should trigger the configuration change branch of the detection logic

Test 4 Generate Windows Error Reporting Artifact for MsMpEng
windows

Uses ProcDump to simulate a crash dump collection from MsMpEng.exe, generating forensic artifacts consistent with a Defender process crash during CVE-2026-45498 exploitation.

Command

powershell 
# Requires Sysinternals ProcDump — run in isolated lab VM only
$mpEngPid = (Get-Process MsMpEng -ErrorAction SilentlyContinue).Id
If ($mpEngPid) {
  & procdump.exe -ma $mpEngPid C:\Temp\MsMpEng_simulated_crash.dmp
  Write-Host "Dump written to C:\Temp\MsMpEng_simulated_crash.dmp"
} Else {
  Write-Host "MsMpEng.exe not running"
}

Cleanup

powershell 
Remove-Item C:\Temp\MsMpEng_simulated_crash.dmp -ErrorAction SilentlyContinue

Expected Telemetry

Process access event against MsMpEng.exe in DeviceEvents (ActionType OpenProcess); file creation event for .dmp file; procdump.exe process creation with MsMpEng PID as argument

Expected Detection

Process memory access to MsMpEng.exe from a non-system process should generate an alert; the .dmp file creation in a temp directory is a forensic artifact matching post-exploitation evidence collection patterns

Related Detections

Tactic Hubs

TA0005Defense EvasionTA0040Impact

Related Techniques

T1562.001Disable or Modify ToolsT1499Endpoint Denial of ServiceT1036Masquerading

Same Tactic: Defense Evasion

Popular Detections