Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-58644.
Upgrade to ProDetect Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644) in Splunk
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
SPL Detection Query
index=sysmon OR index=edr EventCode=1 ParentImage="*\\w3wp.exe*"
| search ParentCommandLine="*SharePoint*" OR ParentCommandLine="*MSSharePoint*"
| search Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\cscript.exe", "*\\wscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\rundll32.exe", "*\\regsvr32.exe", "*\\net.exe", "*\\whoami.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by host, ParentImage, ParentCommandLine, Image, CommandLine, User
| where count > 0
| sort -last_seenIdentifies suspicious child process creation from the SharePoint w3wp.exe worker process, indicative of remote code execution following deserialization exploitation of CVE-2026-58644.
Data Sources
Required Sourcetypes
False Positives & Tuning
- SharePoint farm administration scripts run under the app pool identity
- Scheduled SharePoint timer jobs invoking legitimate utilities
- Monitoring/backup agents hooking into IIS worker processes
Other platforms for CVE-2026-58644
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Suspicious Child Process from w3wp.exe
Expected signal: Sysmon Event ID 1 process creation showing parent process w3wp.exe launching cmd.exe with command line containing 'whoami'.
- Test 2Simulate Webshell Drop in SharePoint Directory
Expected signal: Sysmon Event ID 11 file creation event for test_atomic.aspx under the SharePoint LAYOUTS directory, ideally attributed to w3wp.exe or an interactive PowerShell session.
- Test 3Simulate Encoded PowerShell Execution from IIS Context
Expected signal: Sysmon Event ID 1 showing powershell.exe with -EncodedCommand flag and a parent process context simulating w3wp.exe.
- Test 4Simulate SharePoint ViewState Tampering Request
Expected signal: IIS W3SVC log entry recording the POST request with an oversized/malformed __VIEWSTATE parameter, and a corresponding SharePoint ULS log exception.
References (4)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-58644
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-58644 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month