CVE-2026-68820: Windows Ancillary Function Driver for WinSock (afd.sys) Use-After-Free Privilege Escalation

// CVE-2026-68820 afd.sys UAF LPE — token/integrity escalation and crash signals
let suspiciousParents = dynamic(["cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe","wmiprvse.exe"]);
let escalation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessIntegrityLevel in ("Low","Medium")
| where ProcessIntegrityLevel in ("System","High")
| where InitiatingProcessAccountSid != "S-1-5-18"
| where ProcessTokenElevation == "TokenElevationTypeFull" or AccountName in~ ("system","nt authority\\system")
| where InitiatingProcessParentFileName in~ (suspiciousParents) or InitiatingProcessFileName in~ (suspiciousParents)
| project Timestamp, DeviceName, AccountName, ProcessIntegrityLevel, InitiatingProcessIntegrityLevel, FileName, InitiatingProcessFileName, ProcessCommandLine, ReportId;
let crashes = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("BugCheck","KernelCrash")
| where AdditionalFields has_any ("afd.sys","0x139","0xc2","KERNEL_SECURITY_CHECK_FAILURE")
| project Timestamp, DeviceName, ActionType, AdditionalFields, ReportId;
escalation
| union crashes

index=windows (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (source="WinEventLog:Security" EventCode=4688)
| eval parent=lower(coalesce(ParentImage,ParentProcessName)), img=lower(coalesce(Image,NewProcessName))
| eval integ=coalesce(IntegrityLevel,TokenElevationType)
| where (like(integ,"%System%") OR like(integ,"%High%")) AND (like(parent,"%cmd.exe") OR like(parent,"%powershell.exe") OR like(parent,"%rundll32.exe") OR like(parent,"%regsvr32.exe") OR like(parent,"%mshta.exe") OR like(parent,"%wscript.exe") OR like(parent,"%cscript.exe"))
| append [ search index=windows source="WinEventLog:System" (EventCode=1001 OR EventCode=41) (BugcheckCode="*139*" OR BugcheckCode="*C2*" OR _raw="*afd.sys*") ]
| stats count min(_time) as firstTime max(_time) as lastTime values(img) as spawned_images values(parent) as parents values(User) as users by host
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

sequence by host.id with maxspan=2m
  [ process where event.type == "start" and
      process.parent.name : ("cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe") and
      process.Ext.token.integrity_level_name : ("low","medium") ]
  [ process where event.type == "start" and
      user.name : ("SYSTEM","NT AUTHORITY\\SYSTEM") and
      process.Ext.token.integrity_level_name : ("system","high") ]

SELECT sourceip, "Process Name", "Parent Process Name", "Integrity Level", username, eventCount, MIN(startTime) AS firstSeen, MAX(startTime) AS lastSeen
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Microsoft Sysmon')
  AND ("Integrity Level" ILIKE '%System%' OR "Integrity Level" ILIKE '%High%')
  AND (LOWER("Parent Process Name") LIKE '%cmd.exe' OR LOWER("Parent Process Name") LIKE '%powershell.exe' OR LOWER("Parent Process Name") LIKE '%rundll32.exe' OR LOWER("Parent Process Name") LIKE '%mshta.exe' OR LOWER("Parent Process Name") LIKE '%wscript.exe')
  AND QIDNAME(qid) IMATCHES '.*(Process Create|BugCheck|afd\.sys).*'
GROUP BY sourceip, "Process Name", "Parent Process Name", "Integrity Level", username
LAST 24 HOURS

_sourceCategory=windows/* ("EventID=1" OR "EventID=4688" OR "EventID=1001")
| parse "ParentImage=*" as parentImage nodrop
| parse "Image=*" as image nodrop
| parse "IntegrityLevel=*" as integrity nodrop
| parse "BugcheckCode=*" as bugcheck nodrop
| where (integrity matches /(?i)(System|High)/ and parentImage matches /(?i)(cmd|powershell|rundll32|regsvr32|mshta|wscript|cscript)\.exe/) or (_raw matches /(?i)afd\.sys/ and bugcheck matches /(?i)(139|C2)/)
| count by _sourceHost, parentImage, image, integrity, bugcheck
| sort by _count

rule cve_2026_68820_afd_uaf_lpe {
  meta:
    author = "argus"
    description = "Detects afd.sys use-after-free LPE (CVE-2026-68820) via integrity escalation and bugcheck signals"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)\\(cmd|powershell|rundll32|regsvr32|mshta|wscript|cscript)\.exe$`)
    re.regex($e.security_result.detection_fields["integrity_level"], `(?i)(System|High)`)
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=/^(ProcessRollup2|KernelBugCheck)$/
| case {
    #event_simpleName=ProcessRollup2 | ImageFileName=/(?i)\\.+\.exe$/ ;
    * ;
  }
| ParentBaseFileName=/(?i)^(cmd|powershell|rundll32|regsvr32|mshta|wscript|cscript)\.exe$/
| IntegrityLevel=/(?i)(System|High)/ OR BugCheckCode=/(?i)(0x139|0xc2)/
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, IntegrityLevel], function=count())
| sort(_count, order=desc)