Microsoft SharePoint Code Injection (CVE-2026-65660) Exploitation

let sharepointProcs = dynamic(["w3wp.exe", "owstimer.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "csc.exe", "cscript.exe", "wscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (sharepointProcs)
| where FileName in~ (suspiciousChildren)
| where isnotempty(ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(ParentImage="*\\w3wp.exe" OR ParentImage="*\\owstimer.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\csc.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as command_lines by host, ParentImage, Image, User
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name : ("w3wp.exe", "owstimer.exe") and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "csc.exe", "cscript.exe", "wscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")

SELECT QIDNAME(qid) AS event_name, "Parent Process Name" AS parent_process, "Process Name" AS child_process, "Process CommandLine" AS command_line, sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOWER("Parent Process Name") LIKE '%w3wp.exe' OR LOWER("Parent Process Name") LIKE '%owstimer.exe' AND (LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe' OR LOWER("Process Name") LIKE '%csc.exe' OR LOWER("Process Name") LIKE '%certutil.exe' OR LOWER("Process Name") LIKE '%mshta.exe') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*windows* ("w3wp.exe" OR "owstimer.exe")
| where (parentImage matches "*w3wp.exe" or parentImage matches "*owstimer.exe")
| where (image matches "*cmd.exe" or image matches "*powershell.exe" or image matches "*pwsh.exe" or image matches "*csc.exe" or image matches "*certutil.exe" or image matches "*mshta.exe" or image matches "*cscript.exe")
| count by host, parentImage, image, user, commandLine
| sort by _count desc

rule sharepoint_cve_2026_65660_code_injection {
  meta:
    author = "Argus"
    description = "SharePoint worker process spawning interpreter/compiler - CVE-2026-65660 code injection"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)\\(w3wp|owstimer)\.exe$`)
    re.regex($e.target.process.file.full_path, `(?i)\\(cmd|powershell|pwsh|csc|cscript|wscript|mshta|certutil|bitsadmin)\.exe$`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(w3wp|owstimer)\.exe$/i
| ImageFileName=/\\(cmd|powershell|pwsh|csc|cscript|wscript|mshta|certutil|bitsadmin)\.exe$/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, UserName], function=collect([CommandLine]))
| sort(field=_count, order=desc)