Detect Microsoft SharePoint Code Injection (CVE-2026-65660) Exploitation in CrowdStrike LogScale
Detects exploitation of CVE-2026-65660, a code injection vulnerability (CWE-94) in Microsoft SharePoint Server that is listed in CISA KEV as actively exploited. Successful exploitation allows an attacker to inject and execute arbitrary code in the SharePoint application context, typically observed as the SharePoint IIS worker process (w3wp.exe) spawning command interpreters or writing web shells (e.g., .aspx/.ashx) into layouts/upload directories. This detection surfaces anomalous child process creation from SharePoint worker processes, suspicious file writes to SharePoint web-accessible paths, and injection indicators in SharePoint/IIS logs across multiple SIEM dialects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(w3wp|owstimer)\.exe$/i
| ImageFileName=/\\(cmd|powershell|pwsh|csc|cscript|wscript|mshta|certutil|bitsadmin)\.exe$/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, UserName], function=collect([CommandLine]))
| sort(field=_count, order=desc)CrowdStrike CQL (LogScale) query surfacing SharePoint worker processes spawning interpreters/compilers indicative of CVE-2026-65660.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate ASP.NET compilation via csc.exe
- SharePoint solution/patch deployment activity
- Agents launching helper processes under the SharePoint app pool
Other platforms for CVE-2026-65660
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SharePoint worker spawns command interpreter
Expected signal: Sysmon Event ID 1 / DeviceProcessEvents showing w3wp.exe as parent of cmd.exe with a whoami command line.
- Test 2Simulated web shell write to layouts directory
Expected signal: Sysmon Event ID 11 / DeviceFileEvents showing .aspx creation in a LAYOUTS path.
- Test 3PowerShell compilation via csc invocation
Expected signal: Process creation event for csc.exe with a /out compilation command line.
References (5)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
- https://nvd.nist.gov/vuln/detail/CVE-2026-65660
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html
Response Playbook
Triage
- Confirm the source host is a SharePoint Server and identify the app pool identity of the initiating w3wp.exe process.
- Review the full command line of the spawned child process (cmd/powershell/csc) and any encoded or base64 payloads for malicious intent.
- Correlate the process event timing with IIS/SharePoint ULS logs for the corresponding inbound request (URL, ToolPane.aspx, /_layouts/ paths) to identify the injection vector.
- Determine whether a web shell (.aspx/.ashx) was written to a web-accessible directory such as LAYOUTS or the site content directories.
Containment
- Isolate the affected SharePoint server from the network to prevent lateral movement and data exfiltration.
- Recycle/stop the affected IIS application pool and quarantine any identified web shell files.
- Rotate the SharePoint machine keys (ValidationKey/DecryptionKey) and service account credentials, since KEV exploitation of this class often involves key theft for persistent forgery.
Evidence Collection
- Preserve IIS logs, SharePoint ULS logs, and Sysmon/EDR process telemetry from the affected server.
- Capture copies of any suspicious files written to /_layouts/, TEMPLATE, or content directories along with their file hashes and timestamps.
- Export the memory and disk image of the SharePoint worker process if advanced forensic analysis is required.
Escalation Criteria
- !Escalate to incident response immediately if a web shell is confirmed or if the child process executed reconnaissance, credential access, or lateral movement commands.
- !Escalate to CISA/regulatory reporting if the asset is in scope for BOD 26-04 or handles regulated data.
- !Escalate if machine key material or service account credentials are suspected compromised, requiring farm-wide key rotation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
New or modified .aspx/.ashx files in /_layouts/, TEMPLATE, or content directories - >
IIS access log entries for anomalous POST requests to SharePoint endpoints (e.g., ToolPane.aspx) - >
Sysmon Event ID 1 records showing w3wp.exe as parent of interpreter/compiler processes - >
SharePoint ULS log correlation entries around the exploitation timeframe
Tuning Guidance
Baseline legitimate csc.exe activity from ASP.NET runtime compilation and exclude the specific SharePoint temporary compilation paths to reduce noise. Whitelist known SharePoint deployment/maintenance jobs and their command lines. Prioritize alerts where the child process command line contains encoded payloads, network utilities, or file writes to web-accessible directories, and where the initiating request path matches known SharePoint exploitation endpoints.
Hunting Queries
Hunts for web shell files written into SharePoint web-accessible directories by the IIS worker process, a hallmark of post-exploitation persistence for CVE-2026-65660.
DeviceFileEvents | where InitiatingProcessFileName =~ "w3wp.exe" | where FolderPath has_any ("\\TEMPLATE\\LAYOUTS\\", "\\wwwroot\\") | where FileName endswith ".aspx" or FileName endswith ".ashx" | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessAccountNameindex=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 Image="*\\w3wp.exe" (TargetFilename="*\\LAYOUTS\\*" OR TargetFilename="*\\wwwroot\\*") (TargetFilename="*.aspx" OR TargetFilename="*.ashx") | table _time host TargetFilename UserAtomic Red Team Tests
Simulates code injection outcome by having a process named like the SharePoint worker spawn cmd.exe to run reconnaissance.
Command
copy C:\Windows\System32\cmd.exe %TEMP%\w3wp.exe & %TEMP%\w3wp.exe /c "whoami & hostname"Cleanup
del %TEMP%\w3wp.exeExpected Telemetry
Sysmon Event ID 1 / DeviceProcessEvents showing w3wp.exe as parent of cmd.exe with a whoami command line.
Expected Detection
KQL/SPL/EQL process rules fire on SharePoint-worker-named parent spawning cmd.exe.
Writes a benign .aspx file into a simulated SharePoint LAYOUTS path to test web shell file-write detection.
Command
mkdir "C:\Temp\TEMPLATE\LAYOUTS" 2>nul & echo ^<%@ Page Language="C#" %^> > "C:\Temp\TEMPLATE\LAYOUTS\test_shell.aspx"Cleanup
del "C:\Temp\TEMPLATE\LAYOUTS\test_shell.aspx"Expected Telemetry
Sysmon Event ID 11 / DeviceFileEvents showing .aspx creation in a LAYOUTS path.
Expected Detection
Hunting query for .aspx writes to SharePoint web-accessible directories fires.
Simulates dynamic code injection by invoking csc.exe to compile arbitrary code, mimicking runtime code-injection behavior.
Command
echo public class T{public static void Main(){System.Console.WriteLine("t");}} > %TEMP%\t.cs & "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /out:%TEMP%\t.exe %TEMP%\t.csCleanup
del %TEMP%\t.cs %TEMP%\t.exeExpected Telemetry
Process creation event for csc.exe with a /out compilation command line.
Expected Detection
Detection fires when csc.exe is spawned in the context of the SharePoint worker process.