CVE-2026-50522 Splunk · SPL

Detect Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522) in Splunk

Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

SPL Detection Query

Splunk (SPL)
spl 
index=iis OR index=sysmon sourcetype=WinEventLog:Sysmon EventCode=1
 ParentImage="*w3wp.exe"
 (CommandLine="*SharePoint*" OR ParentCommandLine="*SharePoint*")
 Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*cscript.exe","*wscript.exe","*certutil.exe","*whoami.exe")
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine
| sort -_time
critical severity high confidence

Detects suspicious child process creation from the SharePoint w3wp.exe worker process, indicative of exploitation of CVE-2026-50522.

Data Sources

SysmonWindows Event Logs

Required Sourcetypes

WinEventLog:SysmonWinEventLog:Security

False Positives & Tuning

  • Scheduled SharePoint timer jobs invoking PowerShell cmdlets
  • Legitimate SharePoint farm administration scripts
  • EDR/AV agents momentarily attaching to w3wp.exe

Other platforms for CVE-2026-50522

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate w3wp.exe spawning cmd.exe

    Expected signal: Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)

  2. Test 2Drop simulated webshell file into LAYOUTS directory

    Expected signal: Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path

  3. Test 3Simulate PowerShell execution from SharePoint worker context

    Expected signal: Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument

  4. Test 4Simulate outbound connection from SharePoint app pool process

    Expected signal: Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process

Last updated: 2026-07-23 Research depth: standard
References (6)

Response Playbook

Triage

  1. Confirm the SharePoint farm/server version and patch level against Microsoft's advisory for CVE-2026-50522 to validate exposure.
  2. Review IIS logs and ULS logs for anomalous POST requests to SharePoint application pages (e.g., _layouts, _vti_bin, or web service endpoints) around the alert timestamp, looking for oversized or serialized payloads.
  3. Correlate w3wp.exe child-process alerts with the alerting host to determine whether the SharePoint app pool spawned cmd.exe, powershell.exe, or a webshell-like process.
  4. Check the SharePoint web application's App_Data, LAYOUTS, and wwwroot directories for recently dropped .aspx, .asmx, or .dll files.
  5. Determine whether the affected server has outbound network connections initiated by w3wp.exe to unfamiliar external IPs, indicating C2 or data staging.

Containment

  1. Isolate the affected SharePoint server(s) from the network while preserving forensic state, prioritizing internet-facing/front-end servers.
  2. Disable or restrict the vulnerable SharePoint application pool/service temporarily, or apply Microsoft's emergency mitigation/patch for CVE-2026-50522 if isolation is not feasible.
  3. Rotate SharePoint machine keys (ValidationKey/DecryptionKey) and reset service account credentials if compromise is suspected, since leaked machine keys are commonly used to forge ViewState payloads in these attacks.
  4. Block identified malicious source IPs and webshell URLs at the WAF/perimeter firewall.

Evidence Collection

  1. Preserve IIS/W3SVC logs, ULS logs, and Windows Security/Sysmon event logs covering the suspected exploitation window.
  2. Capture memory and disk images of the affected SharePoint server(s), including the App_Data, LAYOUTS, and IIS temp compilation directories, prior to remediation.
  3. Export any dropped .aspx/.asmx/.dll webshells and suspicious child-process command lines for malware analysis and IOC extraction.
  4. Collect network flow/PCAP data for the affected host to identify C2 infrastructure or lateral movement.

Escalation Criteria

  • !Escalate to incident response leadership if evidence of successful RCE (webshell drop, credential dumping, or lateral movement) is confirmed on an internet-facing SharePoint server.
  • !Escalate if the affected SharePoint environment hosts sensitive data, is integrated with on-prem Active Directory, or shows signs of ToolShell-style chained exploitation (machine key theft leading to persistent access).
  • !Escalate to executive/legal stakeholders if data exfiltration is suspected, given CISA KEV listing and BOD 26-04 mandatory remediation timelines.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS/W3SVC and SharePoint ULS logs showing anomalous requests to SharePoint application or web service pages
  • >Sysmon Event ID 1 (process creation) showing w3wp.exe spawning cmd.exe/powershell.exe
  • >Files recently written to SharePoint LAYOUTS, App_Data, or ASP.NET temporary compilation directories
  • >SharePoint machine key (ValidationKey/DecryptionKey) configuration in web.config, which may have been exfiltrated to forge payloads

Tuning Guidance

Baseline normal SharePoint administrative automation (timer jobs, farm solution deployments, backup agents) that legitimately spawn child processes or write files under the app pool identity before enabling blocking actions. Scope detections to internet-facing SharePoint front-end servers first, then expand to internal farms. Suppress known-good deployment pipelines by process command-line hash or signed publisher where possible rather than by process name alone.

Hunting Queries

Hunts for webshell files dropped by the SharePoint worker process into web-accessible or compilation directories following deserialization exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FolderPath has_any ("LAYOUTS", "App_Data", "Temporary ASP.NET Files")
| where FileName endswith ".aspx" or FileName endswith ".asmx" or FileName endswith ".dll"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessAccountName
Hunting — SPL
spl 
index=sysmon EventCode=11 Image="*w3wp.exe" (TargetFilename="*LAYOUTS*" OR TargetFilename="*App_Data*" OR TargetFilename="*Temporary ASP.NET Files*") (TargetFilename="*.aspx" OR TargetFilename="*.asmx" OR TargetFilename="*.dll") | table _time, ComputerName, TargetFilename, User

Atomic Red Team Tests

Test 1 Simulate w3wp.exe spawning cmd.exe
windows

Simulates the SharePoint worker process spawning a command shell, mimicking post-exploitation behavior of CVE-2026-50522.

Command

powershell 
# Lab-only: run as a service masquerading as w3wp.exe context
Start-Process -FilePath "cmd.exe" -ArgumentList "/c whoami" -PassThru

Cleanup

powershell 
Stop-Process -Name cmd -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with parent process w3wp.exe (or simulated parent)

Expected Detection

KQL/SPL rules alerting on w3wp.exe spawning cmd.exe

Test 2 Drop simulated webshell file into LAYOUTS directory
windows

Simulates a webshell being written to a SharePoint LAYOUTS-like directory to test file-creation detections.

Command

powershell 
New-Item -Path "C:\temp\LAYOUTS_sim\shell.aspx" -ItemType File -Value "<%-- test webshell marker --%>" -Force

Cleanup

powershell 
Remove-Item -Path "C:\temp\LAYOUTS_sim\shell.aspx" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 file creation event for shell.aspx under a LAYOUTS-like path

Expected Detection

Hunting query/alert for .aspx file creation initiated by w3wp.exe process context

Test 3 Simulate PowerShell execution from SharePoint worker context
windows

Simulates PowerShell being invoked with an encoded command as would occur during post-exploitation reconnaissance.

Command

powershell 
powershell.exe -NoProfile -EncodedCommand JABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUA

Cleanup

powershell 
# No persistent artifacts; no cleanup required

Expected Telemetry

Sysmon Event ID 1 for powershell.exe with -EncodedCommand argument

Expected Detection

KQL/SPL alert on encoded PowerShell execution from w3wp.exe parent process

Test 4 Simulate outbound connection from SharePoint app pool process
windows

Simulates the SharePoint worker process making an outbound connection to an external test endpoint, mimicking C2 beaconing after exploitation.

Command

powershell 
Invoke-WebRequest -Uri "http://169.254.169.254/latency-check" -UseBasicParsing -TimeoutSec 3

Cleanup

powershell 
# No persistent artifacts; no cleanup required

Expected Telemetry

Network connection event and Sysmon Event ID 3 originating from the simulated w3wp.exe process

Expected Detection

Network-based hunting query flagging outbound connections from w3wp.exe to unfamiliar external hosts

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections