Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50522.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in Elastic Security
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
Elastic Detection Query
sequence by host.id with maxspan=2m
[process where event.type == "start" and process.parent.name : "w3wp.exe" and process.parent.command_line : "*SharePoint*"]
[process where event.type == "start" and process.name : ("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","certutil.exe")]Detects a SharePoint w3wp.exe process spawning a suspicious child process consistent with exploitation of CVE-2026-50522.
Data Sources
Required Tables
False Positives & Tuning
- SharePoint farm maintenance scripts run via app pool identity
- Legitimate third-party add-in automation
- Monitoring agents scanning the w3wp.exe process
Other platforms for CVE-2026-50522
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate w3wp.exe spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)
- Test 2Drop simulated webshell file into LAYOUTS directory
Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path
- Test 3Simulate PowerShell execution from SharePoint worker context
Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument
- Test 4Simulate outbound connection from SharePoint app pool process
Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process
References (6)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- http://www.zerodayinitiative.com/advisories/ZDI-26-413/
- http://www.zerodayinitiative.com/advisories/ZDI-26-412/
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50522 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month