Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-58644.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644) in IBM QRadar
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
QRadar Detection Query
SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Process Path", "Parent Process Name", "Command Line" FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Sysmon')
AND "Parent Process Name" ILIKE '%w3wp.exe%'
AND "Parent Command Line" ILIKE '%SharePoint%'
AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%cscript.exe%' OR "Process Name" ILIKE '%wscript.exe%' OR "Process Name" ILIKE '%mshta.exe%' OR "Process Name" ILIKE '%certutil.exe%' OR "Process Name" ILIKE '%rundll32.exe%' OR "Process Name" ILIKE '%regsvr32.exe%')
LAST 24 HOURSFlags process creation events where the SharePoint IIS worker process (w3wp.exe) spawns interpreters or living-off-the-land binaries, consistent with post-exploitation of CVE-2026-58644.
Data Sources
Required Tables
False Positives & Tuning
- Authorized SharePoint farm administration scripts
- Scheduled timer jobs invoking system utilities under the app pool account
- Third-party monitoring agents instrumented in the worker process
Other platforms for CVE-2026-58644
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Suspicious Child Process from w3wp.exe
Expected signal: Sysmon Event ID 1 process creation showing parent process w3wp.exe launching cmd.exe with command line containing 'whoami'.
- Test 2Simulate Webshell Drop in SharePoint Directory
Expected signal: Sysmon Event ID 11 file creation event for test_atomic.aspx under the SharePoint LAYOUTS directory, ideally attributed to w3wp.exe or an interactive PowerShell session.
- Test 3Simulate Encoded PowerShell Execution from IIS Context
Expected signal: Sysmon Event ID 1 showing powershell.exe with -EncodedCommand flag and a parent process context simulating w3wp.exe.
- Test 4Simulate SharePoint ViewState Tampering Request
Expected signal: IIS W3SVC log entry recording the POST request with an oversized/malformed __VIEWSTATE parameter, and a corresponding SharePoint ULS log exception.
References (4)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-58644
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-58644 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month