Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50522.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in Google Chronicle
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
YARA-L Detection Query
rule sharepoint_deserialization_cve_2026_50522 {
meta:
description = "Detects suspicious child processes spawned from SharePoint w3wp.exe consistent with CVE-2026-50522 exploitation"
severity = "CRITICAL"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
$proc.principal.process.parent_process.file.full_path = /w3wp\.exe/i
$proc.principal.process.parent_process.command_line = /SharePoint/i
$proc.target.process.file.full_path = /(cmd\.exe|powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|certutil\.exe)/i
condition:
$proc
}Detects suspicious process creation events where the SharePoint IIS worker process spawns a shell or scripting interpreter, consistent with exploitation of CVE-2026-50522.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SharePoint automation scripts
- Backup/AV integrations attaching to the worker process
- Scheduled maintenance tasks executed under the app pool identity
Other platforms for CVE-2026-50522
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate w3wp.exe spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)
- Test 2Drop simulated webshell file into LAYOUTS directory
Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path
- Test 3Simulate PowerShell execution from SharePoint worker context
Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument
- Test 4Simulate outbound connection from SharePoint app pool process
Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process
References (6)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- http://www.zerodayinitiative.com/advisories/ZDI-26-413/
- http://www.zerodayinitiative.com/advisories/ZDI-26-412/
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50522 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month