Which SIEM platforms have a CVE-2026-45659 detection rule?

df00tech provides CVE-2026-45659 (CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659)?

Detecting CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE requires the following data sources: W3CIISLog, SecurityEvent, DeviceProcessEvents.

What severity and confidence is the CVE-2026-45659 detection?

The CVE-2026-45659 detection is rated critical severity with high confidence.

What are common false positives for CVE-2026-45659?

Common false positives for CVE-2026-45659 include: Legitimate SharePoint administrative operations that generate large POST requests to _layouts or _vti_bin endpoints; Automated backup or migration tools that interact with SharePoint APIs using non-browser user agents; SharePoint health analyzer or monitoring tools spawning diagnostic child processes from w3wp.exe.

CVE-2026-45659: CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE — Detection (KQL, SPL, Sigma + 5 SIEMs)

Microsoft Sentinel / Defender

kusto

let suspiciousSharePointPaths = dynamic(["/sites/", "/_layouts/", "/_vti_bin/", "/Lists/", "/_api/"]);
let knownBadUserAgents = dynamic(["python-requests", "curl", "Go-http-client", "masscan", "nuclei"]);
union
(
  W3CIISLog
  | where csUriStem has_any ("_vti_bin", "_layouts", "viewlsts.aspx", "upload.aspx")
  | where csMethod in ("POST", "PUT")
  | where sc_status in (200, 500, 503)
  | where cs_bytes > 5000
  | extend isSuspiciousUA = csUserAgent has_any (knownBadUserAgents)
  | project TimeGenerated, csUriStem, csMethod, sc_status, cs_bytes, csUserAgent, cIp, isSuspiciousUA, Computer
),
(
  SecurityEvent
  | where EventID in (4688, 4689)
  | where ParentProcessName has_any ("w3wp.exe", "owstimer.exe", "microsoft.sharepoint.exe")
  | where NewProcessName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
  | project TimeGenerated, Account, Computer, ParentProcessName, NewProcessName, CommandLine, ProcessId
),
(
  DeviceProcessEvents
  | where InitiatingProcessFileName in~ ("w3wp.exe", "owstimer.exe")
  | where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
)
| extend AlertName = "CVE-2026-45659 SharePoint Deserialization Exploitation Attempt"

Detects SharePoint deserialization exploitation via IIS logs showing anomalous POST requests to sensitive endpoints combined with child process spawning from SharePoint worker processes (w3wp.exe).

critical severity high confidence

Data Sources

W3CIISLog SecurityEvent DeviceProcessEvents

Required Tables

W3CIISLog SecurityEvent DeviceProcessEvents

False Positives

Legitimate SharePoint administrative operations that generate large POST requests to _layouts or _vti_bin endpoints
Automated backup or migration tools that interact with SharePoint APIs using non-browser user agents
SharePoint health analyzer or monitoring tools spawning diagnostic child processes from w3wp.exe

Splunk

spl

index=iis OR index=wineventlog OR index=sysmon
| eval src_category=case(
    sourcetype="iis", "web",
    sourcetype="WinEventLog:Security", "process",
    sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "sysmon",
    true(), "unknown"
  )
| eval is_sharepoint_process=if(match(ParentImage, "(?i)(w3wp|owstimer|microsoft\.sharepoint)"), 1, 0)
| eval is_suspicious_child=if(match(Image, "(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe)"), 1, 0)
| eval is_sharepoint_endpoint=if(match(cs_uri_stem, "(?i)(_vti_bin|_layouts|viewlsts\.aspx|upload\.aspx|_api)"), 1, 0)
| eval is_large_post=if(cs_method="POST" AND cs_bytes > 5000, 1, 0)
| where (src_category="web" AND is_sharepoint_endpoint=1 AND is_large_post=1)
    OR (src_category IN ("process", "sysmon") AND is_sharepoint_process=1 AND is_suspicious_child=1)
| eval alert_type=case(
    src_category="web", "SharePoint Suspicious HTTP Request",
    src_category IN ("process", "sysmon"), "SharePoint Worker Process Spawned Suspicious Child",
    true(), "Unknown"
  )
| table _time, host, src_ip, cs_uri_stem, cs_method, sc_status, cs_bytes, ParentImage, Image, CommandLine, alert_type
| sort -_time

Detects CVE-2026-45659 exploitation via IIS logs for anomalous POSTs to SharePoint endpoints and Sysmon/Security events for suspicious child processes spawned by SharePoint worker processes.

critical severity high confidence

Data Sources

IIS Web Logs Windows Security Event Log Sysmon

Required Sourcetypes

iis WinEventLog:Security XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Legitimate third-party SharePoint integrations making large API calls to _vti_bin or _layouts endpoints
SharePoint farm configuration scripts that invoke PowerShell from administrative contexts tied to w3wp.exe
Antivirus or EDR agents spawning child processes for scanning operations initiated via SharePoint worker processes

Elastic Security (EQL)

eql

sequence by host.name with maxspan=2m
  [network where event.category == "network" and
   destination.port in (80, 443, 8080) and
   http.request.method in ("POST", "PUT") and
   (
     url.path like~ "*_vti_bin*" or
     url.path like~ "*_layouts*" or
     url.path like~ "*viewlsts.aspx*" or
     url.path like~ "*_api*"
   ) and
   http.request.body.bytes > 5000
  ]
  [process where event.category == "process" and event.type == "start" and
   process.parent.name in~ ("w3wp.exe", "owstimer.exe") and
   process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe")
  ]

EQL sequence detection correlating anomalous HTTP POST requests to SharePoint endpoints with subsequent suspicious child process creation from SharePoint IIS worker processes within a 2-minute window.

critical severity high confidence

Data Sources

Elastic Endpoint Network Packet Capture Windows Event Logs

Required Tables

logs-endpoint.events.network-* logs-endpoint.events.process-*

False Positives

Legitimate SharePoint PowerShell administration scripts executing in close temporal proximity to large API calls
SharePoint migration or content management tools that both upload large payloads and invoke system utilities
Security scanning tools that probe SharePoint endpoints and trigger process spawning on the server

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "BytesSent",
  "Application",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LAST 24 HOURS
  AND (
    (
      logsourcetypename(devicetype) ILIKE '%IIS%'
      AND URL ILIKE ANY ('%_vti_bin%', '%_layouts%', '%viewlsts.aspx%', '%_api/%', '%upload.aspx%')
      AND "HTTPMethod" IN ('POST', 'PUT')
      AND CAST("BytesSent" AS BIGINT) > 5000
    )
    OR
    (
      logsourcetypename(devicetype) ILIKE '%Windows%'
      AND "ParentProcessPath" ILIKE ANY ('%w3wp.exe%', '%owstimer.exe%')
      AND "ProcessPath" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%rundll32.exe%')
    )
  )
ORDER BY starttime DESC

QRadar AQL query detecting CVE-2026-45659 SharePoint deserialization exploitation through IIS log anomalies and Windows process creation events showing suspicious child processes from SharePoint worker processes.

critical severity medium confidence

Data Sources

IIS Web Logs Windows Security Events Microsoft SharePoint Logs

Required Tables

events

False Positives

SharePoint farm administrators running PowerShell scripts that upload content via the web front-end
Legitimate content management or migration operations using large payloads against SharePoint APIs
Scheduled SharePoint timer jobs (owstimer.exe) that legitimately spawn child processes for maintenance tasks

Sumo Logic CSE

sql

_sourceCategory=iis OR _sourceCategory=windows/security OR _sourceCategory=sysmon
| parse "* * * * * * * * * * * * *" as date, time, s_sitename, s_computername, s_ip, cs_method, cs_uri_stem, cs_uri_query, s_port, cs_username, c_ip, cs_useragent, sc_status nodrop
| parse "ProcessId=* ParentProcessId=* Image=* ParentImage=* CommandLine=*" as pid, ppid, image, parent_image, cmdline nodrop
| eval is_iis_record = if(!isNull(cs_method), 1, 0)
| eval is_process_record = if(!isNull(image), 1, 0)
| eval sharepoint_endpoint = if(is_iis_record=1 AND (cs_method in ("POST","PUT")) AND (cs_uri_stem matches "(?i).*(_vti_bin|_layouts|_api|upload\.aspx|viewlsts\.aspx).*"), 1, 0)
| eval suspicious_child = if(is_process_record=1 AND (parent_image matches "(?i).*(w3wp|owstimer)\.exe.*") AND (image matches "(?i).*(cmd|powershell|wscript|cscript|mshta|rundll32|certutil|bitsadmin)\.exe.*"), 1, 0)
| where sharepoint_endpoint=1 OR suspicious_child=1
| eval detection_type = if(sharepoint_endpoint=1, "Suspicious SharePoint HTTP Request", "SharePoint Process Spawned Malicious Child")
| fields _sourceHost, _sourceCategory, detection_type, cs_uri_stem, cs_method, sc_status, c_ip, image, parent_image, cmdline
| sort by _messageTime desc

Sumo Logic query detecting SharePoint deserialization exploitation by correlating IIS log entries for anomalous POST requests to sensitive SharePoint endpoints with process creation events showing suspicious child processes spawned by w3wp.exe.

critical severity medium confidence

Data Sources

IIS Web Logs Windows Security Events Sysmon

False Positives

SharePoint document library operations involving large file uploads through the _layouts or _vti_bin interfaces
Automated SharePoint reporting or analytics tools making scheduled POST requests to SharePoint APIs
IT operations scripts that interact with SharePoint and invoke system utilities as part of normal workflows

Google Chronicle / SecOps

yaral

rule cve_2026_45659_sharepoint_deserialization {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-45659 SharePoint Server deserialization exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    yara_version = "YL2.0"
    rule_version = "1.0"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659"

  events:
    // Web request to sensitive SharePoint endpoint with large POST body
    (
      $web_request.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($web_request.network.http.target_url, `(?i)(_vti_bin|_layouts|_api|upload\.aspx|viewlsts\.aspx)`)
      )
      and $web_request.network.http.method = "POST"
      and $web_request.network.sent_bytes > 5000
      and $web_request.principal.hostname = $host
    )
    or
    // Suspicious child process spawned from SharePoint/IIS worker
    (
      $proc_event.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($proc_event.principal.process.file.full_path, `(?i)(w3wp|owstimer)\.exe`)
      and re.regex($proc_event.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|certutil|bitsadmin)\.exe`)
      and $proc_event.principal.hostname = $host
    )

  match:
    $host over 2m

  outcome:
    $risk_score = max(
      if($web_request.network.sent_bytes > 10000, 85, 70),
      if($proc_event.target.process.file.full_path != "", 95, 0)
    )

  condition:
    $web_request or $proc_event
}

Chronicle YARA-L rule detecting CVE-2026-45659 SharePoint deserialization exploitation through anomalous HTTP POST requests to sensitive SharePoint paths and suspicious child process spawning from IIS worker processes.

critical severity high confidence

Data Sources

Chronicle UDM Google Cloud IDS Windows Event Logs

Required Tables

UDM Events

False Positives

Legitimate SharePoint Online or on-premises content sync operations generating large POST payloads to API endpoints
SharePoint farm administrative PowerShell operations running in context of IIS application pool identity
Third-party SharePoint add-ins or connectors that invoke system processes as part of integration workflows

CrowdStrike LogScale (CQL)

cql

// CVE-2026-45659 SharePoint Deserialization - Child Process from IIS Worker
#event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2")
| ParentBaseFileName IN~ ("w3wp.exe", "owstimer.exe", "microsoft.sharepoint.exe")
| FileName IN~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe", "msiexec.exe")
| eval suspicious_cmdline = if(match(CommandLine, "(?i)(whoami|net user|ipconfig|systeminfo|download|invoke-|iex|encodedcommand|bypass|webclient|downloadstring|base64)"), 1, 0)
| eval risk_score = case(
    suspicious_cmdline = 1 AND ParentBaseFileName IN~ ("w3wp.exe"), 95,
    suspicious_cmdline = 0 AND ParentBaseFileName IN~ ("w3wp.exe"), 75,
    true(), 60
  )
| where risk_score >= 60
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, suspicious_cmdline, risk_score
| sort -risk_score, -timestamp

CrowdStrike Falcon CQL query detecting SharePoint deserialization exploitation by identifying suspicious child processes spawned from SharePoint IIS worker processes, with risk scoring based on command-line indicators.

critical severity high confidence

Data Sources

CrowdStrike Falcon Endpoint CrowdStrike Process Events

Required Tables

ProcessRollup2 SyntheticProcessRollup2

False Positives

SharePoint health monitoring scripts that legitimately spawn cmd.exe or PowerShell for diagnostics
Security tools running in the context of the IIS application pool that invoke system utilities for scanning
SharePoint workflow actions or custom solutions that invoke system processes as part of business logic

Vulnerability Intelligence

CVE

Affected Software

Weakness (CWE)

Timeline

References & Proof of Concept

CVSS

What is CVE-2026-45659 CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for CVE-2026-45659

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox