CVE-2026-58644 IBM QRadar · QRadar

Detect Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644) in IBM QRadar

Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Process Path", "Parent Process Name", "Command Line" FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Sysmon')
AND "Parent Process Name" ILIKE '%w3wp.exe%'
AND "Parent Command Line" ILIKE '%SharePoint%'
AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%cscript.exe%' OR "Process Name" ILIKE '%wscript.exe%' OR "Process Name" ILIKE '%mshta.exe%' OR "Process Name" ILIKE '%certutil.exe%' OR "Process Name" ILIKE '%rundll32.exe%' OR "Process Name" ILIKE '%regsvr32.exe%')
LAST 24 HOURS
critical severity high confidence

Flags process creation events where the SharePoint IIS worker process (w3wp.exe) spawns interpreters or living-off-the-land binaries, consistent with post-exploitation of CVE-2026-58644.

Data Sources

Windows Security Event LogSysmon

Required Tables

events

False Positives & Tuning

  • Authorized SharePoint farm administration scripts
  • Scheduled timer jobs invoking system utilities under the app pool account
  • Third-party monitoring agents instrumented in the worker process

Other platforms for CVE-2026-58644

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Suspicious Child Process from w3wp.exe

    Expected signal: Sysmon Event ID 1 process creation showing parent process w3wp.exe launching cmd.exe with command line containing 'whoami'.

  2. Test 2Simulate Webshell Drop in SharePoint Directory

    Expected signal: Sysmon Event ID 11 file creation event for test_atomic.aspx under the SharePoint LAYOUTS directory, ideally attributed to w3wp.exe or an interactive PowerShell session.

  3. Test 3Simulate Encoded PowerShell Execution from IIS Context

    Expected signal: Sysmon Event ID 1 showing powershell.exe with -EncodedCommand flag and a parent process context simulating w3wp.exe.

  4. Test 4Simulate SharePoint ViewState Tampering Request

    Expected signal: IIS W3SVC log entry recording the POST request with an oversized/malformed __VIEWSTATE parameter, and a corresponding SharePoint ULS log exception.

Last updated: 2026-07-17 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the alerting host is a SharePoint server (check IIS site bindings and running w3wp.exe application pools) and identify the affected application pool/site collection.
  2. Review the full command line and parent-child process lineage of the suspicious child process to determine if it matches known post-exploitation patterns (encoded PowerShell, webshell writes, LOLBin abuse).
  3. Check IIS logs and SharePoint ULS logs for anomalous POST requests to ViewState, REST (_api), SOAP (_vti_bin), or custom application pages around the time of the alert, especially large or malformed payloads.
  4. Determine if the vulnerable SharePoint server is internet-facing; CISA KEV listing indicates active exploitation, so internet-exposed instances should be treated as high priority.
  5. Search for newly created or modified .aspx files in SharePoint web application directories (webshells) and unexpected DLLs loaded by w3wp.exe.

Containment

  1. Isolate the affected SharePoint server from the network (or restrict inbound traffic to trusted admin IPs only) while preserving the host for forensic collection.
  2. Disable or restrict the affected application pool/site if active exploitation is confirmed, and rotate machine keys and service account credentials used by the SharePoint farm.
  3. Apply the vendor security update addressing CVE-2026-58644 to all affected SharePoint servers, prioritizing internet-facing instances per CISA BOD 26-04 guidance.

Evidence Collection

  1. Collect IIS W3SVC logs, SharePoint ULS logs, and Sysmon/EDR process, file, and network telemetry for the affected host covering the suspected exploitation window.
  2. Preserve memory and disk images of the affected SharePoint server, including any suspected webshell files, before remediation actions overwrite evidence.
  3. Export w3wp.exe process tree, loaded modules, and any dropped files or scheduled tasks created around the time of the alert.

Escalation Criteria

  • !Escalate immediately if a webshell, unauthorized administrative account, or lateral movement (e.g., LSASS access, SMB/WinRM connections to other hosts) is confirmed originating from the SharePoint server.
  • !Escalate to incident response leadership if the SharePoint server is internet-facing, given active KEV exploitation status, or if evidence indicates data exfiltration from SharePoint content databases.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS W3SVC logs showing POST requests to SharePoint endpoints (ViewState, _api, _vti_bin, custom pages) with anomalous payload sizes or content types
  • >SharePoint ULS (Unified Logging Service) logs capturing exceptions or errors related to deserialization/ViewState validation failures
  • >Newly created or modified .aspx/.ashx files within the SharePoint 15/16 hive or web application content directories
  • >Sysmon Event ID 1 (process creation) and Event ID 11 (file creation) records showing w3wp.exe spawning processes or writing files

Tuning Guidance

Baseline known legitimate SharePoint automation accounts, scheduled timer jobs, and third-party add-ins that intentionally spawn child processes from w3wp.exe, and add them as exclusions by process hash, parent command-line pattern, or service account. Because exploitation of CVE-2026-58644 is confirmed active (CISA KEV), avoid broadly suppressing this detection; instead narrow false positives with allowlists for verified maintenance scripts and monitor internet-facing SharePoint farms with the highest priority per CISA BOD 26-04.

Hunting Queries

Hunts for suspicious file writes of .aspx/.ashx files by the SharePoint w3wp.exe process, indicative of webshell deployment following deserialization exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileNameExtension in~ ("aspx","ashx","asmx")
| where FolderPath has_any ("TEMPLATE\\LAYOUTS", "wwwroot", "15\\TEMPLATE", "16\\TEMPLATE")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, ActionType
| order by TimeGenerated desc
Hunting — SPL
spl 
index=sysmon EventCode=11 Image="*\\w3wp.exe*" TargetFilename="*.aspx" OR TargetFilename="*.ashx"
| stats count by host, Image, TargetFilename, _time
| sort -_time

Atomic Red Team Tests

Test 1 Simulate Suspicious Child Process from w3wp.exe
windows

Simulates a SharePoint worker process spawning a command interpreter, mimicking post-deserialization-exploitation command execution.

Command

powershell 
powershell.exe -Command "Start-Process -FilePath 'cmd.exe' -ArgumentList '/c whoami' -WindowStyle Hidden" # Run this from a process renamed/impersonating w3wp.exe in a lab VM for detection validation only

Cleanup

powershell 
Terminate any spawned cmd.exe/whoami.exe processes; no persistent changes are made.

Expected Telemetry

Sysmon Event ID 1 process creation showing parent process w3wp.exe launching cmd.exe with command line containing 'whoami'.

Expected Detection

KQL/SPL/EQL rules should trigger on w3wp.exe spawning cmd.exe in the lab environment.

Test 2 Simulate Webshell Drop in SharePoint Directory
windows

Simulates dropping a benign .aspx test file into a SharePoint LAYOUTS directory to validate webshell-drop detection logic (lab environment only, non-functional test file).

Command

powershell 
powershell.exe -Command "'<%@ Page Language=\"C#\" %><%-- test artifact --%>' | Out-File -FilePath 'C:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\80\\_layouts\\15\\test_atomic.aspx' -Encoding ascii"

Cleanup

powershell 
Remove-Item 'C:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\80\\_layouts\\15\\test_atomic.aspx' -Force

Expected Telemetry

Sysmon Event ID 11 file creation event for test_atomic.aspx under the SharePoint LAYOUTS directory, ideally attributed to w3wp.exe or an interactive PowerShell session.

Expected Detection

File-creation hunting query should surface the new .aspx artifact for analyst review.

Test 3 Simulate Encoded PowerShell Execution from IIS Context
windows

Simulates a base64-encoded PowerShell command execution pattern commonly observed after successful web application deserialization exploits.

Command

powershell 
powershell.exe -EncodedCommand JABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgA= # decodes to a benign $PSVersionTable.PSVersion read for lab validation

Cleanup

powershell 
No persistent artifacts created; no cleanup required beyond closing the PowerShell session.

Expected Telemetry

Sysmon Event ID 1 showing powershell.exe with -EncodedCommand flag and a parent process context simulating w3wp.exe.

Expected Detection

Detections monitoring encoded PowerShell execution spawned from IIS worker processes should alert on this activity.

Test 4 Simulate SharePoint ViewState Tampering Request
linux

Sends a crafted HTTP POST with an anomalous __VIEWSTATE parameter to a lab SharePoint test page to validate IIS/ULS log-based hunting for malformed deserialization payloads.

Command

bash 
curl -s -X POST 'http://sharepoint-lab.local/_layouts/15/test.aspx' --data '__VIEWSTATE=AAAA_TEST_MALFORMED_PAYLOAD_AAAA&__EVENTVALIDATION=TEST' -H 'Content-Type: application/x-www-form-urlencoded'

Cleanup

bash 
No server-side state change occurs from the malformed request; no cleanup required.

Expected Telemetry

IIS W3SVC log entry recording the POST request with an oversized/malformed __VIEWSTATE parameter, and a corresponding SharePoint ULS log exception.

Expected Detection

Log-based hunting queries against IIS/ULS logs should flag the anomalous ViewState payload for review.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.001PowerShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections