Microsoft MsQuic (MsQuic.OpenSSL/Schannel) Use-After-Free RCE — CVE-2026-62815

// Vulnerable MsQuic binary presence + crash/child-process anomalies
let vulnBinaries = dynamic(["msquic.dll", "libmsquic.so", "msquic.lib"]);
let knownQuicHosts = DeviceProcessEvents
| where FileName has_any ("msquic", "quic")
| distinct DeviceId;
union
(
    DeviceImageLoadEvents
    | where FileName in~ (vulnBinaries)
    | extend FileVersionParsed = tostring(SHA1) // version detail best-effort
    | project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
    | extend Signal = "vulnerable_msquic_binary_loaded"
),
(
    DeviceProcessEvents
    | where DeviceId in (knownQuicHosts)
    | where InitiatingProcessFileName has "quic" or InitiatingProcessCommandLine has "msquic"
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","whoami.exe","net.exe","rundll32.exe")
    | project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
    | extend Signal = "suspicious_child_of_quic_service"
)
| order by Timestamp desc

(index=main OR index=edr) (sourcetype="Sysmon:ImageLoad" OR sourcetype="WinEventLog:Sysmon" EventCode=7) (ImageLoaded="*msquic.dll*" OR ImageLoaded="*libmsquic.so*")
| eval signal="vulnerable_msquic_binary_loaded"
| append [ search (sourcetype="Sysmon:ProcessCreate" OR EventCode=1) (ParentImage="*quic*" OR ParentCommandLine="*msquic*") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*/bash" OR Image="*/sh" OR Image="*\\rundll32.exe")
  | eval signal="suspicious_child_of_quic_service" ]
| table _time host signal Image ParentImage CommandLine ImageLoaded
| sort - _time

sequence by host.id with maxspan=2m
  [ library where dll.name in ("msquic.dll", "libmsquic.so") ]
  [ process where event.type == "start" and
      process.parent.name : ("*quic*") and
      process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "rundll32.exe") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "Process Name" AS process, "Parent Process Name" AS parent, "Image Loaded" AS module, starttime FROM events WHERE ("Image Loaded" ILIKE '%msquic.dll%' OR "Image Loaded" ILIKE '%libmsquic.so%') OR ("Parent Process Name" ILIKE '%quic%' AND ("Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell.exe%' OR "Process Name" ILIKE '%/bash%' OR "Process Name" ILIKE '%rundll32.exe%')) ORDER BY starttime DESC LAST 24 HOURS

(_sourceCategory=*sysmon* OR _sourceCategory=*edr*) ("msquic.dll" OR "libmsquic.so" OR ("quic" AND ("cmd.exe" OR "powershell.exe" OR "/bash" OR "rundll32.exe")))
| parse "ImageLoaded=*\"" as image_loaded nodrop
| parse "ParentImage=*\"" as parent_image nodrop
| parse "Image=*\"" as image nodrop
| where image_loaded matches "*msquic*" or (parent_image matches "*quic*" and image matches "*cmd.exe*" or image matches "*powershell.exe*")
| count by _sourceHost, image, parent_image, image_loaded
| sort by _count desc

rule msquic_cve_2026_62815_exploitation {
  meta:
    author = "Argus"
    description = "Detects vulnerable MsQuic module load and suspicious QUIC-parented process for CVE-2026-62815"
    severity = "HIGH"
    reference = "https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33"
  events:
    (
      $e.metadata.event_type = "PROCESS_MODULE_LOAD" and
      re.regex($e.target.file.full_path, `(?i)(msquic\.dll|libmsquic\.so)`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.principal.process.parent_process.file.full_path, `(?i)quic`) and
      $e.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|\/bash|\/sh|rundll32\.exe)/
    )
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=/ImageLoad|ClassifiedModuleLoad/ AND (ImageFileName=/msquic\.dll/i OR ImageFileName=/libmsquic\.so/i)
| union([
    #event_simpleName=ProcessRollup2 AND ParentBaseFileName=/quic/i AND FileName=/(cmd\.exe|powershell\.exe|bash|sh|rundll32\.exe)/i
  ])
| groupBy([aid, ComputerName, FileName, ParentBaseFileName, ImageFileName], limit=max)
| sort(order=desc)