CVE-2026-45659 Elastic Security · Elastic

Detect CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE in Elastic Security

Detects exploitation of CVE-2026-45659, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. Successful exploitation allows remote code execution by sending crafted serialized .NET objects to SharePoint web endpoints. This CVE is listed in CISA KEV indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=2m
  [network where event.category == "network" and
   destination.port in (80, 443, 8080) and
   http.request.method in ("POST", "PUT") and
   (
     url.path like~ "*_vti_bin*" or
     url.path like~ "*_layouts*" or
     url.path like~ "*viewlsts.aspx*" or
     url.path like~ "*_api*"
   ) and
   http.request.body.bytes > 5000
  ]
  [process where event.category == "process" and event.type == "start" and
   process.parent.name in~ ("w3wp.exe", "owstimer.exe") and
   process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe")
  ]
critical severity high confidence

EQL sequence detection correlating anomalous HTTP POST requests to SharePoint endpoints with subsequent suspicious child process creation from SharePoint IIS worker processes within a 2-minute window.

Data Sources

Elastic EndpointNetwork Packet CaptureWindows Event Logs

Required Tables

logs-endpoint.events.network-*logs-endpoint.events.process-*

False Positives & Tuning

  • Legitimate SharePoint PowerShell administration scripts executing in close temporal proximity to large API calls
  • SharePoint migration or content management tools that both upload large payloads and invoke system utilities
  • Security scanning tools that probe SharePoint endpoints and trigger process spawning on the server

Other platforms for CVE-2026-45659

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-45659 SharePoint Deserialization Simulation via ysoserial.net

    Expected signal: IIS logs should show POST request to /_vti_bin/UserProfileService.asmx with large cs-bytes; Sysmon Event ID 1 should capture cmd.exe spawned by w3wp.exe with CommandLine containing whoami

  2. Test 2SharePoint Worker Process Suspicious Child Simulation

    Expected signal: Sysmon Event ID 1 showing cmd.exe execution with Network Service account; Windows Security Event ID 4688 capturing process creation with suspicious command line arguments

  3. Test 3SharePoint Endpoint Fuzzing and Web Shell Upload Detection Test

    Expected signal: Sysmon Event ID 11 (FileCreate) capturing .aspx file creation in SharePoint web directory path; Windows Security Event ID 4663 (file access) if object access auditing is enabled

Last updated: 2026-07-02 Research depth: standard
References (4)

Unlock Pro Content

Get the full detection package for CVE-2026-45659 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections