CVE-2026-45659 IBM QRadar · QRadar

Detect CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE in IBM QRadar

Detects exploitation of CVE-2026-45659, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. Successful exploitation allows remote code execution by sending crafted serialized .NET objects to SharePoint web endpoints. This CVE is listed in CISA KEV indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "BytesSent",
  "Application",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LAST 24 HOURS
  AND (
    (
      logsourcetypename(devicetype) ILIKE '%IIS%'
      AND URL ILIKE ANY ('%_vti_bin%', '%_layouts%', '%viewlsts.aspx%', '%_api/%', '%upload.aspx%')
      AND "HTTPMethod" IN ('POST', 'PUT')
      AND CAST("BytesSent" AS BIGINT) > 5000
    )
    OR
    (
      logsourcetypename(devicetype) ILIKE '%Windows%'
      AND "ParentProcessPath" ILIKE ANY ('%w3wp.exe%', '%owstimer.exe%')
      AND "ProcessPath" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%rundll32.exe%')
    )
  )
ORDER BY starttime DESC
critical severity medium confidence

QRadar AQL query detecting CVE-2026-45659 SharePoint deserialization exploitation through IIS log anomalies and Windows process creation events showing suspicious child processes from SharePoint worker processes.

Data Sources

IIS Web LogsWindows Security EventsMicrosoft SharePoint Logs

Required Tables

events

False Positives & Tuning

  • SharePoint farm administrators running PowerShell scripts that upload content via the web front-end
  • Legitimate content management or migration operations using large payloads against SharePoint APIs
  • Scheduled SharePoint timer jobs (owstimer.exe) that legitimately spawn child processes for maintenance tasks

Other platforms for CVE-2026-45659

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-45659 SharePoint Deserialization Simulation via ysoserial.net

    Expected signal: IIS logs should show POST request to /_vti_bin/UserProfileService.asmx with large cs-bytes; Sysmon Event ID 1 should capture cmd.exe spawned by w3wp.exe with CommandLine containing whoami

  2. Test 2SharePoint Worker Process Suspicious Child Simulation

    Expected signal: Sysmon Event ID 1 showing cmd.exe execution with Network Service account; Windows Security Event ID 4688 capturing process creation with suspicious command line arguments

  3. Test 3SharePoint Endpoint Fuzzing and Web Shell Upload Detection Test

    Expected signal: Sysmon Event ID 11 (FileCreate) capturing .aspx file creation in SharePoint web directory path; Windows Security Event ID 4663 (file access) if object access auditing is enabled

Last updated: 2026-07-02 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted host is running Microsoft SharePoint Server and identify the specific version/patch level to determine if CVE-2026-45659 patches have been applied via Windows Update or MSRC advisory.
  2. Review IIS logs on the SharePoint WFE (Web Front End) servers for POST requests to sensitive endpoints (_vti_bin, _layouts, _api) with unusually large payloads (>5KB) originating from unexpected external IP addresses.
  3. Check for new or modified files in SharePoint web directories (C:\inetpub\wwwroot\wss\, C:\Program Files\Common Files\microsoft shared\Web Server Extensions\) that may indicate web shell deployment following successful deserialization.
  4. Examine Windows Security Event Log (Event ID 4688) and Sysmon Event ID 1 on SharePoint servers for child processes spawned by w3wp.exe or owstimer.exe that are not consistent with normal SharePoint operations.

Containment

  1. Immediately isolate the affected SharePoint server(s) from network access at the firewall or NSG level if active exploitation is confirmed, while preserving in-memory forensic evidence by capturing a memory dump before isolation.
  2. Apply Microsoft's official patch for CVE-2026-45659 from the MSRC advisory to all SharePoint Server instances. If patching is not immediately feasible, implement WAF rules to block POST requests with large payloads to known vulnerable SharePoint endpoints.

Evidence Collection

  1. Collect full IIS access logs, application event logs, and Windows Security event logs from all SharePoint WFE and application servers covering the period 72 hours prior to detection through the time of containment.
  2. Capture memory dumps of w3wp.exe worker processes on affected SharePoint servers using tools such as ProcDump (e.g., procdump.exe -ma w3wp.exe sharepoint_memdump.dmp) to preserve in-memory artifacts including deserialized .NET objects and injected shellcode.

Escalation Criteria

  • !Escalate to Incident Response leadership if web shell files are discovered in SharePoint web directories or if lateral movement indicators are observed (e.g., new admin accounts created, SMB connections to internal servers from the SharePoint host).
  • !Escalate immediately if the SharePoint server stores sensitive data such as PII, financial records, intellectual property, or credentials, as CVE-2026-45659 is listed in CISA KEV indicating active exploitation in the wild.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS logs at C:\inetpub\logs\LogFiles\W3SVC* showing POST requests to _vti_bin or _layouts endpoints with large cs-bytes values
  • >Prefetch files (C:\Windows\Prefetch\) for cmd.exe, powershell.exe executed by w3wp.exe confirming post-exploitation command execution
  • >Windows Event ID 4688 (process creation) logs showing suspicious child process chains originating from w3wp.exe or owstimer.exe
  • >New or modified ASPX files in C:\inetpub\wwwroot\wss\ or C:\Program Files\Common Files\microsoft shared\Web Server Extensions\ indicating web shell deployment
  • >.NET serialization-related entries in Windows Application Event Log (Event Source: ASP.NET) including BinaryFormatter or DataContractSerializer errors

Tuning Guidance

Begin by baselining w3wp.exe child process behavior on SharePoint servers during normal operations to identify legitimate maintenance processes (e.g., SharePoint Health Analyzer). Whitelist known-good PowerShell scripts by hash or path that are routinely invoked by SharePoint timer jobs. For IIS log detections, tune the payload size threshold (default 5KB) based on your environment's typical SharePoint API usage — environments with large document libraries may need higher thresholds. Correlate detections with patch status data to prioritize alerts from unpatched systems. Consider suppressing alerts from known SharePoint admin IP ranges while maintaining visibility into external-origin requests.

Hunting Queries

Hunt for ASPX/ASHX web shell files created in SharePoint web directories by processes associated with the IIS worker or post-exploitation tools, indicating persistence after CVE-2026-45659 exploitation.

Hunting — KQL
kql 
// Hunt for web shells deployed after SharePoint deserialization exploitation
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("\\wss\\", "\\Web Server Extensions\\", "\\inetpub\\wwwroot")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx"
| where InitiatingProcessFileName in~ ("w3wp.exe", "owstimer.exe", "cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
Hunting — SPL
spl 
index=sysmon EventCode=11
| eval is_sharepoint_path=if(match(TargetFilename, "(?i)(\\\\wss\\\\|Web Server Extensions|inetpub\\\\wwwroot)"), 1, 0)
| eval is_webshell_ext=if(match(TargetFilename, "(?i)\.(aspx|ashx|asmx)$"), 1, 0)
| where is_sharepoint_path=1 AND is_webshell_ext=1
| table _time, host, TargetFilename, Image, CommandLine
| sort -_time

Atomic Red Team Tests

Test 1 CVE-2026-45659 SharePoint Deserialization Simulation via ysoserial.net
windows

Simulates the deserialization exploitation vector by generating a .NET deserialization gadget chain payload using ysoserial.net and sending it to a SharePoint endpoint. This test validates that IIS logs and process creation detections trigger appropriately.

Command

powershell 
# Lab-only: requires ysoserial.net and a test SharePoint instance
# Step 1: Generate payload
.\ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -o base64 -c "cmd.exe /c whoami > C:\Windows\Temp\pwned.txt" | Set-Content C:\Temp\payload_b64.txt

# Step 2: Decode and POST to SharePoint endpoint
$payload = [Convert]::FromBase64String((Get-Content C:\Temp\payload_b64.txt))
$uri = "http://sharepoint-lab/_vti_bin/UserProfileService.asmx"
$response = Invoke-WebRequest -Uri $uri -Method POST -Body $payload -ContentType "application/octet-stream" -UseDefaultCredentials
Write-Output "Response status: $($response.StatusCode)"

Cleanup

powershell 
Remove-Item C:\Windows\Temp\pwned.txt -ErrorAction SilentlyContinue; Remove-Item C:\Temp\payload_b64.txt -ErrorAction SilentlyContinue

Expected Telemetry

IIS logs should show POST request to /_vti_bin/UserProfileService.asmx with large cs-bytes; Sysmon Event ID 1 should capture cmd.exe spawned by w3wp.exe with CommandLine containing whoami

Expected Detection

Both the KQL W3CIISLog query (large POST to _vti_bin endpoint) and SecurityEvent/Sysmon query (cmd.exe child of w3wp.exe) should fire within the detection window

Test 2 SharePoint Worker Process Suspicious Child Simulation
windows

Directly simulates the post-exploitation behavior of a successful SharePoint deserialization attack by launching suspicious child processes as if they were spawned from w3wp.exe, to test process-based detections without requiring a vulnerable SharePoint instance.

Command

powershell 
# Lab-only: simulate child process from w3wp.exe context using PsExec or scheduled task
# Method: Create scheduled task running as IIS AppPool identity then trigger via w3wp.exe simulation
schtasks /create /tn "SharePoint-Sim-Test" /tr "cmd.exe /c whoami && ipconfig /all > C:\Windows\Temp\recon.txt" /sc once /st 00:00 /ru "Network Service" /f
schtasks /run /tn "SharePoint-Sim-Test"
Start-Sleep -Seconds 5
Get-Content C:\Windows\Temp\recon.txt

Cleanup

powershell 
schtasks /delete /tn "SharePoint-Sim-Test" /f; Remove-Item C:\Windows\Temp\recon.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe execution with Network Service account; Windows Security Event ID 4688 capturing process creation with suspicious command line arguments

Expected Detection

CrowdStrike CQL and Splunk SPL process-based detections should identify the cmd.exe execution with reconnaissance commands (whoami, ipconfig) and generate high-risk-score alerts

Test 3 SharePoint Endpoint Fuzzing and Web Shell Upload Detection Test
windows

Tests detection of web shell deployment following SharePoint deserialization exploitation by creating a benign ASPX file in a simulated SharePoint web directory path and verifying that file-creation monitoring detections trigger.

Command

powershell 
# Lab-only: create a benign test file in SharePoint web directory to test file monitoring
$testPath = "C:\inetpub\wwwroot\wss\VirtualDirectories\"
If (-not (Test-Path $testPath)) { New-Item -ItemType Directory -Path $testPath }
$webshellContent = '<%@ Page Language="C#" %><% Response.Write("DETECTION_TEST_ONLY"); %>'
$webshellContent | Out-File -FilePath "${testPath}detection_test_$(Get-Date -Format 'yyyyMMddHHmmss').aspx" -Encoding UTF8
Write-Output "Test file created: ${testPath}"

Cleanup

powershell 
Remove-Item "C:\inetpub\wwwroot\wss\VirtualDirectories\detection_test_*.aspx" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) capturing .aspx file creation in SharePoint web directory path; Windows Security Event ID 4663 (file access) if object access auditing is enabled

Expected Detection

The hunting query for web shell detection (DeviceFileEvents / Sysmon EventCode=11 for .aspx files in SharePoint paths) should alert on the newly created test file within the configured detection window

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections