CVE-2026-72530 Microsoft Sentinel · KQL

Detect TrueConf Server Code Injection (CVE-2026-72530) in Microsoft Sentinel

Detects exploitation of CVE-2026-72530, a code injection vulnerability (CWE-94) in TrueConf Server that allows an attacker to break out of the isolated environment and execute arbitrary code on the host. The flaw is listed in CISA KEV, indicating active in-the-wild exploitation. Detection focuses on the TrueConf Server service processes (e.g., trueconf, mcu, web components) spawning unexpected child processes such as shells, script interpreters, or reconnaissance/LOLBin utilities — a strong indicator that injected code is being executed by the server process rather than legitimate conferencing workloads.

MITRE ATT&CK

Tactic
Initial Access Execution

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let tcParents = dynamic(["trueconf.exe","mcu.exe","trueconf_server.exe","vcs.exe","webmanager.exe","tcserver.exe"]);
let suspChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","bash.exe","whoami.exe","net.exe","net1.exe","nltest.exe","certutil.exe","bitsadmin.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (tcParents)
| where FileName in~ (suspChildren)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, AccountDomain, ProcessId
| order by Timestamp desc
critical severity high confidence

Flags TrueConf Server processes spawning shell interpreters, script hosts, or reconnaissance LOLBins — behavior consistent with code injection exploitation of CVE-2026-72530.

Data Sources

Microsoft Defender for EndpointWindows Security Events

Required Tables

DeviceProcessEvents

False Positives & Tuning

  • Legitimate TrueConf administrative maintenance scripts invoked by an operator during patching windows
  • Endpoint management or backup agents that inject helper processes into service contexts
  • Security scanners performing authenticated inspection of the TrueConf host

Other platforms for CVE-2026-72530

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate TrueConf process spawning cmd.exe

    Expected signal: Sysmon EID 1 / EDR process-create with ParentImage mcu.exe and child cmd.exe/whoami.exe

  2. Test 2TrueConf-mimic PowerShell download cradle

    Expected signal: Process-create event with parent webmanager.exe launching powershell/pwsh with a -Command payload

  3. Test 3Linux TrueConf service breakout simulation

    Expected signal: execve/auditd event with a trueconf-named parent executing id/uname

Last updated: 2026-08-21 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the parent process is a genuine TrueConf Server component and identify the host role (public-facing MCU, web manager, or internal node).
  2. Review the full command line of the spawned child process for encoded/obfuscated content, network callbacks, or download commands (certutil, bitsadmin, powershell -enc).
  3. Correlate the event timestamp with TrueConf web/API access logs to find the inbound request that triggered code execution.
  4. Check whether the TrueConf Server version on the host is patched per the TrueConf security advisory; unpatched KEV-listed hosts are high priority.

Containment

  1. Isolate the affected TrueConf host from the network to prevent lateral movement and further breakout from the isolated environment.
  2. Suspend the TrueConf Server service and block inbound access to its web/management ports at the firewall until patched.
  3. Rotate credentials and service-account secrets that the TrueConf process had access to, given code executed in its context.

Evidence Collection

  1. Capture the full process tree, command lines, and loaded modules for the TrueConf parent and all child processes.
  2. Preserve TrueConf Server application/web logs, IIS/embedded web-server access logs, and Sysmon/EDR process and network telemetry around the event.
  3. Image or snapshot the host and collect any dropped files, scripts, or web shells written by the injected code.

Escalation Criteria

  • !Escalate to IR immediately if the child process established outbound C2, downloaded tooling, or spawned further processes indicating hands-on-keyboard activity.
  • !Escalate if evidence shows breakout from the TrueConf isolated environment onto the host OS or movement to other internal systems.
  • !Escalate to management/legal if sensitive conferencing data or credentials appear accessed or exfiltrated.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Process creation events (Sysmon EID 1 / EDR) showing TrueConf components as parents of shells or LOLBins
  • >TrueConf web/API access logs and embedded web-server logs recording the malicious inbound request
  • >Dropped files, scripts, or web shells in TrueConf web/upload directories
  • >Network connection telemetry from the TrueConf process to unexpected external hosts

Tuning Guidance

Establish a baseline of legitimate child processes the TrueConf service spawns in your environment (updaters, media helpers) and allowlist those specific images/paths. Prioritize alerts where the child is a shell, script host, or download utility, or where the command line contains encoding, network, or file-write indicators. Tighten severity for internet-exposed MCU/web-manager hosts and lower noise by excluding known administrative maintenance windows.

Hunting Queries

Baselines all child processes spawned by TrueConf Server components to surface anomalous shell/LOLBin executions for CVE-2026-72530 hunting.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName has "trueconf" or InitiatingProcessFileName in~ ("mcu.exe","vcs.exe","webmanager.exe") | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*trueconf*" OR ParentImage="*mcu.exe" OR ParentImage="*webmanager.exe") | stats count by Image, CommandLine, host | sort - count

Atomic Red Team Tests

Test 1 Simulate TrueConf process spawning cmd.exe
windows

Renames a benign binary to mimic a TrueConf component and has it launch cmd.exe to validate parent/child detection.

Command

powershell 
copy C:\Windows\System32\cmd.exe %TEMP%\mcu.exe & %TEMP%\mcu.exe /c "whoami"

Cleanup

powershell 
del %TEMP%\mcu.exe

Expected Telemetry

Sysmon EID 1 / EDR process-create with ParentImage mcu.exe and child cmd.exe/whoami.exe

Expected Detection

KQL, SPL, and EDR rules fire on TrueConf-named parent spawning cmd.exe/whoami.exe

Test 2 TrueConf-mimic PowerShell download cradle
windows

Simulates injected code using a TrueConf-named parent to run an encoded PowerShell download command.

Command

powershell 
copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe %TEMP%\webmanager.exe & %TEMP%\webmanager.exe -NoProfile -Command "Write-Output 'poc-cve-2026-72530'"

Cleanup

powershell 
del %TEMP%\webmanager.exe

Expected Telemetry

Process-create event with parent webmanager.exe launching powershell/pwsh with a -Command payload

Expected Detection

All SIEM rules match TrueConf-named parent spawning a PowerShell interpreter

Test 3 Linux TrueConf service breakout simulation
linux

Simulates the Linux TrueConf Server service account spawning a shell and reconnaissance command, mimicking environment breakout.

Command

bash 
cp /bin/bash /tmp/trueconf_mcu && /tmp/trueconf_mcu -c 'id; uname -a'

Cleanup

bash 
rm -f /tmp/trueconf_mcu

Expected Telemetry

execve/auditd event with a trueconf-named parent executing id/uname

Expected Detection

EDR/process-monitoring rules flag a trueconf-named binary spawning shell recon commands

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1211Exploitation for Defense Evasion

Same Tactic: Initial Access

Popular Detections