CVE-2026-81963 Microsoft Sentinel · KQL

Detect Microsoft Windows Link Following Privilege Escalation (CVE-2026-81963) in Microsoft Sentinel

Detects exploitation attempts against CVE-2026-81963, a Microsoft Windows link following (symbolic link / junction / hardlink) vulnerability (CWE-59, CWE-284) that allows a local attacker to redirect privileged file operations to attacker-controlled targets, resulting in privilege escalation. This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection focuses on the behavioral indicators of link-following abuse: creation of NTFS junctions/reparse points and object-manager symbolic links in user-writable directories, followed by privileged processes writing or deleting through those links. Because affected version data is not published in the intel, this detection is behavior-based rather than version-based and should be paired with patch-status verification.

MITRE ATT&CK

Tactic
Privilege Escalation

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
// CVE-2026-81963 - Windows Link Following abuse: reparse point / junction creation in user-writable dirs followed by privileged write
let linkTools = dynamic(["mklink", "CreateSymbolicLink", "CreateHardLink", "CreateMountPoint"]);
let suspectPaths = dynamic(["\\Users\\Public\\", "\\AppData\\Local\\Temp\\", "\\Windows\\Temp\\", "\\ProgramData\\"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("cmd.exe") and ProcessCommandLine has_any (linkTools))
    or ProcessCommandLine has_any ("mklink /J", "mklink /D", "mklink /H", "New-Item -ItemType Junction", "New-Item -ItemType SymbolicLink")
| where ProcessCommandLine has_any (suspectPaths)
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId, DeviceId
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileDeleted")
    | where InitiatingProcessIntegrityLevel in ("System", "High")
    | where FolderPath has_any (suspectPaths)
    | project FileEventTime = Timestamp, DeviceId, TargetFile = FolderPath, PrivProcess = InitiatingProcessFileName, PrivIntegrity = InitiatingProcessIntegrityLevel
) on DeviceId
| where isempty(FileEventTime) or (FileEventTime between (Timestamp .. (Timestamp + 5m)))
| order by Timestamp desc
high severity medium confidence

Flags creation of NTFS junctions/symlinks in user-writable directories and correlates with privileged (System/High integrity) file writes through the same paths within 5 minutes, the core link-following exploitation pattern.

Data Sources

Microsoft Defender for EndpointDeviceProcessEventsDeviceFileEvents

Required Tables

DeviceProcessEventsDeviceFileEvents

False Positives & Tuning

  • Legitimate use of mklink by administrators or deployment scripts creating junctions for application data redirection
  • Backup, antivirus, or storage-management software that creates reparse points during normal operation
  • Developer tooling (e.g., package managers, build systems) that create symlinks in temp or profile directories

Other platforms for CVE-2026-81963

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create NTFS directory junction in user-writable path

    Expected signal: Sysmon Event ID 1 (process create for cmd.exe with mklink /J) and Event ID 11 / DeviceFileEvents reparse point creation under C:\Users\Public

  2. Test 2Create object symbolic link via PowerShell New-Item

    Expected signal: Sysmon Event ID 1 (powershell.exe New-Item -ItemType SymbolicLink) and file-create telemetry for the symlink in \Windows\Temp

  3. Test 3Privileged write through user-created junction

    Expected signal: Sysmon Event ID 1 for junction creation followed by Event ID 11 with elevated IntegrityLevel writing through the junction into \Windows\Temp

Last updated: 2026-09-09 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the alerting host's Windows patch level against the MSRC advisory for CVE-2026-81963 (https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963); an unpatched host materially raises severity.
  2. Examine the flagged command line and identify the exact junction/symlink source path and its reparse target using 'fsutil reparsepoint query <path>' and 'dir /AL'.
  3. Determine the account and integrity level that created the link versus the privileged process that wrote through it; a low-priv link creator plus a SYSTEM/High writer is the exploitation signature.
  4. Check whether the target of the link resolves to a protected location (e.g., under \Windows\, \Program Files\, or a service's data directory) indicating an attempted privileged overwrite.

Containment

  1. Isolate the affected host from the network if a low-privilege-to-SYSTEM link-following sequence is confirmed.
  2. Remove the malicious reparse point/junction ('fsutil reparsepoint delete <path>' or rmdir) and quarantine any files written through it.
  3. Suspend or disable the compromised user account pending investigation and rotate any credentials that may have been exposed via privileged file writes.

Evidence Collection

  1. Capture Sysmon Event ID 1 (process create) and 11 (file create) records plus Security 4663/4656 object-access events for the source and target paths.
  2. Preserve the reparse point metadata ('fsutil reparsepoint query') and a forensic copy of files created/modified through the link before removal.
  3. Collect the full process tree of the link-creating and privileged-writing processes, including parent process and command line.

Escalation Criteria

  • !Escalate to incident response if a low-integrity process created a link that a SYSTEM/High-integrity process subsequently wrote through to a protected location.
  • !Escalate if the host is confirmed unpatched for CVE-2026-81963 and shows evidence of successful privileged file replacement or new SYSTEM-level persistence.
  • !Escalate if the same link-following pattern is observed across multiple hosts, indicating active campaign exploitation of this KEV-listed CVE.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >NTFS reparse point / $REPARSE_POINT attribute on the malicious junction or symlink
  • >Sysmon Event ID 1 and 11 records and Security 4663 object-access events tied to the link source and target
  • >USN Journal ($UsnJrnl) entries recording the reparse point creation and privileged writes through it

Tuning Guidance

Baseline the administrators, deployment tools, backup agents, and developer machines that legitimately create junctions and symlinks, and exclude their signed process paths or specific service accounts. Tighten confidence by requiring the correlation between a non-privileged link creator and a subsequent SYSTEM/High-integrity write through the same path, and by scoping suspectPaths to directories relevant to your environment. Where possible, join against patch-status inventory to suppress alerts on hosts already remediated for CVE-2026-81963.

Hunting Queries

Surfaces reparse point / symbolic link creation activity in user-writable directories over the past week to hunt for pre-exploitation staging.

Hunting — KQL
kql 
DeviceFileEvents | where Timestamp > ago(7d) | where ActionType == "FileCreated" | where FolderPath has_any ("\\Users\\Public\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\") | where InitiatingProcessCommandLine has_any ("mklink", "CreateSymbolicLink", "Junction") | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath
Hunting — SPL
spl 
index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*mklink*" OR CommandLine="*Junction*" OR CommandLine="*CreateSymbolicLink*") | stats count values(CommandLine) by host, User

Atomic Red Team Tests

Test 1 Create NTFS directory junction in user-writable path
windows

Creates a directory junction from a user-writable location to a target directory, emulating the reparse-point staging step of link-following exploitation.

Command

powershell 
cmd.exe /c mklink /J C:\Users\Public\cve81963_junction C:\Windows\Temp

Cleanup

powershell 
cmd.exe /c rmdir C:\Users\Public\cve81963_junction

Expected Telemetry

Sysmon Event ID 1 (process create for cmd.exe with mklink /J) and Event ID 11 / DeviceFileEvents reparse point creation under C:\Users\Public

Expected Detection

KQL/SPL rule flags mklink junction creation targeting a user-writable directory.

Test 2 Create object symbolic link via PowerShell New-Item
windows

Creates a symbolic link in a temp directory using PowerShell, emulating symlink-based redirection of a privileged file operation.

Command

powershell 
powershell.exe -Command "New-Item -ItemType SymbolicLink -Path C:\Windows\Temp\cve81963_link -Target C:\Users\Public\target.txt"

Cleanup

powershell 
powershell.exe -Command "Remove-Item C:\Windows\Temp\cve81963_link -Force"

Expected Telemetry

Sysmon Event ID 1 (powershell.exe New-Item -ItemType SymbolicLink) and file-create telemetry for the symlink in \Windows\Temp

Expected Detection

Detection matches the New-Item SymbolicLink command line targeting a user-writable directory.

Test 3 Privileged write through user-created junction
windows

Simulates a SYSTEM/High-integrity process writing a file through a previously created junction, completing the link-following exploitation correlation.

Command

powershell 
cmd.exe /c mklink /J C:\ProgramData\cve81963_j C:\Windows\Temp && powershell.exe -Command "Start-Process cmd -Verb RunAs -ArgumentList '/c echo test > C:\ProgramData\cve81963_j\poc.txt'"

Cleanup

powershell 
cmd.exe /c del C:\Windows\Temp\poc.txt & rmdir C:\ProgramData\cve81963_j

Expected Telemetry

Sysmon Event ID 1 for junction creation followed by Event ID 11 with elevated IntegrityLevel writing through the junction into \Windows\Temp

Expected Detection

Correlation rule fires on junction creation in a user-writable path followed by a High/System integrity write through the same path within 5 minutes.

Related Detections

Tactic Hub

TA0004Privilege Escalation

Related Techniques

T1548Abuse Elevation Control MechanismT1574Hijack Execution Flow

Same Tactic: Privilege Escalation

Popular Detections