CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation

let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("svchost.exe","services.exe","lsass.exe","spoolsv.exe","dwm.exe","csrss.exe")
| where FileName in~ (suspiciousChildren)
| where InitiatingProcessIntegrityLevel in~ ("System","High")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessIntegrityLevel, AccountName
| join kind=leftouter (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "ProcessCrashDetected" or ActionType == "AppCrash"
    | project DeviceName, CrashTime=Timestamp, FaultingModule=AdditionalFields
) on DeviceName
| where isempty(CrashTime) or abs(datetime_diff('second', Timestamp, CrashTime)) < 120
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessIntegrityLevel

index=windows (sourcetype="WinEventLog:Application" EventCode=1000) OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| eval crash=if(EventCode==1000,1,0), spawn=if(EventCode==1,1,0)
| eval parent=lower(coalesce(ParentImage,"")), child=lower(coalesce(Image,""))
| where crash==1 OR (spawn==1 AND (like(parent,"%svchost.exe") OR like(parent,"%services.exe") OR like(parent,"%lsass.exe") OR like(parent,"%spoolsv.exe")) AND (like(child,"%cmd.exe") OR like(child,"%powershell.exe") OR like(child,"%rundll32.exe") OR like(child,"%regsvr32.exe") OR like(child,"%mshta.exe")))
| stats min(_time) as firstTime max(_time) as lastTime values(Image) as images values(CommandLine) as cmds values(Faulting_Application_Name) as faultApp by host
| where mvcount(images)>0
| convert ctime(firstTime) ctime(lastTime)

sequence by host.id with maxspan=2m
  [ process where event.type == "end" and process.exit_code != 0 and
      process.parent.name in ("svchost.exe", "services.exe", "lsass.exe", "spoolsv.exe") ]
  [ process where event.type == "start" and
      process.parent.name in ("svchost.exe", "services.exe", "lsass.exe", "spoolsv.exe", "dwm.exe") and
      process.name in ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe") ]

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd, sourceip, username, DATEFORMAT(startTime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Windows%' AND ( ("Event ID" = '1000') OR ( LOWER("Parent Process Name") LIKE '%svchost.exe' OR LOWER("Parent Process Name") LIKE '%services.exe' OR LOWER("Parent Process Name") LIKE '%lsass.exe' OR LOWER("Parent Process Name") LIKE '%spoolsv.exe' ) AND ( LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%rundll32.exe' OR LOWER("Process Name") LIKE '%mshta.exe' ) ) ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*windows* (EventID=1000 OR EventID=1)
| parse "ParentImage=*\"" as parentImage nodrop
| parse "Image=*\"" as image nodrop
| parse "CommandLine=*\"" as commandLine nodrop
| toLowerCase(parentImage) as parentImage
| toLowerCase(image) as image
| where (parentImage matches "*svchost.exe" or parentImage matches "*services.exe" or parentImage matches "*lsass.exe" or parentImage matches "*spoolsv.exe") and (image matches "*cmd.exe" or image matches "*powershell.exe" or image matches "*rundll32.exe" or image matches "*regsvr32.exe" or image matches "*mshta.exe")
| count by _sourceHost, parentImage, image, commandLine
| sort by _count

rule cve_2026_85880_windows_heap_overflow {
  meta:
    author = "argus"
    description = "Privileged Windows service spawning shell/LOLBin, indicative of CVE-2026-85880 heap overflow exploitation"
    severity = "HIGH"
    cve = "CVE-2026-85880"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)\\(svchost|services|lsass|spoolsv)\.exe$`)
    re.regex($e.target.process.file.full_path, `(?i)\\(cmd|powershell|rundll32|regsvr32|mshta|wscript)\.exe$`)
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(svchost|services|lsass|spoolsv)\.exe$/i
| ImageFileName=/\\(cmd|powershell|rundll32|regsvr32|mshta|wscript)\.exe$/i
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName], function=([count(as=cnt), collect([CommandLine])]))
| sort(cnt, order=desc)