Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50522.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in Microsoft Sentinel
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has_any ("SharePoint", "MSSharePoint", "w3wp") or InitiatingProcessFolderPath has "MSSharePoint"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","whoami.exe","net.exe","certutil.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp descDetects suspicious child processes spawned by the SharePoint IIS worker process (w3wp.exe), consistent with post-exploitation of the CVE-2026-50522 deserialization RCE.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SharePoint admin scripts invoked via scheduled tasks under the app pool identity
- Third-party SharePoint add-ins that shell out to PowerShell for maintenance
- Backup/AV agents that briefly attach to w3wp.exe for scanning
Other platforms for CVE-2026-50522
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate w3wp.exe spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)
- Test 2Drop simulated webshell file into LAYOUTS directory
Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path
- Test 3Simulate PowerShell execution from SharePoint worker context
Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument
- Test 4Simulate outbound connection from SharePoint app pool process
Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process
References (6)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-50522
- http://www.zerodayinitiative.com/advisories/ZDI-26-413/
- http://www.zerodayinitiative.com/advisories/ZDI-26-412/
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50522 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month