Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-58644.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644) in CrowdStrike LogScale
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ParentBaseFileName="w3wp.exe"
| ParentCommandLine="*SharePoint*"
| in(field="FileName", values=["cmd.exe","powershell.exe","cscript.exe","wscript.exe","mshta.exe","certutil.exe","rundll32.exe","regsvr32.exe","net.exe","whoami.exe"], ignoreCase=true)
| table([ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, timestamp])
| sort(timestamp, order=desc)CrowdStrike Falcon query detecting suspicious child processes launched by the SharePoint w3wp.exe worker process, indicative of exploitation of the CVE-2026-58644 deserialization vulnerability.
Data Sources
Required Tables
False Positives & Tuning
- Authorized SharePoint farm scripts run by the application pool identity
- Health Analyzer or scheduled timer job automation
- Third-party monitoring/backup agents integrated with IIS worker processes
Other platforms for CVE-2026-58644
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Suspicious Child Process from w3wp.exe
Expected signal: Sysmon Event ID 1 process creation showing parent process w3wp.exe launching cmd.exe with command line containing 'whoami'.
- Test 2Simulate Webshell Drop in SharePoint Directory
Expected signal: Sysmon Event ID 11 file creation event for test_atomic.aspx under the SharePoint LAYOUTS directory, ideally attributed to w3wp.exe or an interactive PowerShell session.
- Test 3Simulate Encoded PowerShell Execution from IIS Context
Expected signal: Sysmon Event ID 1 showing powershell.exe with -EncodedCommand flag and a parent process context simulating w3wp.exe.
- Test 4Simulate SharePoint ViewState Tampering Request
Expected signal: IIS W3SVC log entry recording the POST request with an oversized/malformed __VIEWSTATE parameter, and a corresponding SharePoint ULS log exception.
References (4)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-58644
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-58644 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month