Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522)

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("SharePoint", "MSSharePoint", "w3wp") or InitiatingProcessFolderPath has "MSSharePoint"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","whoami.exe","net.exe","certutil.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

index=iis OR index=sysmon sourcetype=WinEventLog:Sysmon EventCode=1
 ParentImage="*w3wp.exe"
 (CommandLine="*SharePoint*" OR ParentCommandLine="*SharePoint*")
 Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*cscript.exe","*wscript.exe","*certutil.exe","*whoami.exe")
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine
| sort -_time

sequence by host.id with maxspan=2m
 [process where event.type == "start" and process.parent.name : "w3wp.exe" and process.parent.command_line : "*SharePoint*"]
 [process where event.type == "start" and process.name : ("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","certutil.exe")]

SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Parent Process Name", "Command Line" FROM events WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log' AND "Parent Process Name" ILIKE '%w3wp.exe%' AND ("Command Line" ILIKE '%SharePoint%' OR "Parent Command Line" ILIKE '%SharePoint%') AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%cscript.exe%' OR "Process Name" ILIKE '%certutil.exe%') LAST 24 HOURS

_sourceCategory=windows/sysmon OR _sourceCategory=iis/logs
| where ParentImage matches "*w3wp.exe"
| where CommandLine matches "*SharePoint*" or ParentCommandLine matches "*SharePoint*"
| where Image matches "*cmd.exe*" or Image matches "*powershell.exe*" or Image matches "*cscript.exe*" or Image matches "*certutil.exe*"
| count by ComputerName, Image, CommandLine
| sort by _count

rule sharepoint_deserialization_cve_2026_50522 {
  meta:
    description = "Detects suspicious child processes spawned from SharePoint w3wp.exe consistent with CVE-2026-50522 exploitation"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /w3wp\.exe/i
    $proc.principal.process.parent_process.command_line = /SharePoint/i
    $proc.target.process.file.full_path = /(cmd\.exe|powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|certutil\.exe)/i
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName="w3wp.exe"
| ParentCommandLine="*SharePoint*"
| in(field=FileName, values=["cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","certutil.exe"])
| table([ComputerName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, timestamp])
| sort(timestamp, order=desc)