Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50522.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in IBM QRadar
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
QRadar Detection Query
SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Parent Process Name", "Command Line" FROM events WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log' AND "Parent Process Name" ILIKE '%w3wp.exe%' AND ("Command Line" ILIKE '%SharePoint%' OR "Parent Command Line" ILIKE '%SharePoint%') AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%cscript.exe%' OR "Process Name" ILIKE '%certutil.exe%') LAST 24 HOURSDetects suspicious process spawning from the SharePoint IIS worker process indicative of CVE-2026-50522 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SharePoint administrative automation
- Backup agents attaching to w3wp.exe
- Scheduled maintenance jobs on the SharePoint farm
Other platforms for CVE-2026-50522
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate w3wp.exe spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)
- Test 2Drop simulated webshell file into LAYOUTS directory
Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path
- Test 3Simulate PowerShell execution from SharePoint worker context
Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument
- Test 4Simulate outbound connection from SharePoint app pool process
Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process
References (6)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- http://www.zerodayinitiative.com/advisories/ZDI-26-413/
- http://www.zerodayinitiative.com/advisories/ZDI-26-412/
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50522 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month