Which SIEM platforms have a CVE-2026-85880 detection rule?

df00tech provides CVE-2026-85880 (CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2026-85880 detection?

The CVE-2026-85880 detection is rated high severity with medium confidence.

What are common false positives for CVE-2026-85880?

Common false positives for CVE-2026-85880 include: Legitimate administrative scripts launched by scheduled tasks running as SYSTEM; Software deployment agents (SCCM, Intune) invoking cmd/powershell from service context; Backup or monitoring agents spawning shells from privileged service processes.

CVE-2026-85880 Google Chronicle · YARA-L

Detect CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation in Google Chronicle

Q: What data sources are required to detect CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation (CVE-2026-85880)?

Detecting CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation requires the following data sources: Microsoft Defender for Endpoint, DeviceProcessEvents, DeviceEvents.

Detects exploitation attempts and post-exploitation activity associated with CVE-2026-85880, a heap-based buffer overflow (CWE-122) with use of uninitialized resource (CWE-908) in Microsoft Windows. Listed in the CISA KEV catalog (disclosed 2026-09-08), this vulnerability is actively exploited to achieve memory corruption leading to elevation of privilege or remote code execution. Detection focuses on process crash telemetry (WER/faulting module), anomalous child processes spawned from Windows components, suspicious memory operations, and privilege-escalation indicators following a crash, since no public PoC or specific affected-version list is available and exploitation manifests primarily as crash-then-execute behavior.

MITRE ATT&CK

Tactic: Privilege Escalation Execution

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule cve_2026_85880_windows_heap_overflow {
  meta:
    author = "argus"
    description = "Privileged Windows service spawning shell/LOLBin, indicative of CVE-2026-85880 heap overflow exploitation"
    severity = "HIGH"
    cve = "CVE-2026-85880"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)\\(svchost|services|lsass|spoolsv)\.exe$`)
    re.regex($e.target.process.file.full_path, `(?i)\\(cmd|powershell|rundll32|regsvr32|mshta|wscript)\.exe$`)
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

high severity medium confidence

Chronicle YARA-L rule detecting privileged Windows service processes launching shells or LOLBins, the observable post-exploitation behavior of CVE-2026-85880.

Data Sources

Windows EDR telemetrySysmon via Chronicle forwarder

Required Tables

udm.events

False Positives & Tuning

Legitimate SYSTEM automation launching command interpreters
Software deployment agents running as service accounts
Monitoring agents spawning helper processes

Other platforms for CVE-2026-85880

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate privileged service spawning a shell
Expected signal: ProcessRollup2 / DeviceProcessEvents record showing cmd.exe spawned at SYSTEM integrity from a service context.
Test 2Generate an application crash event
Expected signal: Application event log EventCode 1000 and a WER crash dump for the faulting process.
Test 3LOLBin spawned from service context
Expected signal: Process-creation telemetry showing rundll32.exe launched from a service (services.exe) parent at SYSTEM integrity.

Last updated: 2026-09-09 Research depth: standard

References (4)

Response Playbook

Triage

Confirm the alerting host is a Windows system and identify whether the parent service process (svchost/services/lsass/spoolsv) crashed shortly before the child process was spawned by reviewing WER and EventCode 1000 records.
Determine the Windows build/patch level and cross-reference against the MSRC advisory for CVE-2026-85880 to confirm whether the host is missing the fix.
Examine the spawned child process command line, parent lineage, and integrity level to assess whether execution occurred at System/High privilege.
Check for concurrent authentication anomalies (new admin sessions, token manipulation) that would indicate successful privilege escalation.

Containment

Isolate the affected host from the network via EDR containment to prevent lateral movement while preserving volatile evidence.
Suspend or terminate the suspicious child process tree and disable any persistence (services, scheduled tasks, run keys) created after the crash.
Force a credential reset for accounts that were active on the host, prioritizing privileged/service accounts if System-level execution is confirmed.

Evidence Collection

Capture a full memory image and the WER crash dumps for the faulting Windows component before rebooting to preserve heap-corruption artifacts.
Collect Sysmon/EDR process telemetry, Application event log crash records, and the child-process command lines and dropped files for the incident window.
Export scheduled tasks, services, and autorun entries created or modified around the crash timestamp.

Escalation Criteria

!Escalate to incident response immediately if child-process execution is confirmed at SYSTEM integrity following a service crash.
!Escalate to threat-intel/vulnerability management if the host is confirmed unpatched against CVE-2026-85880 given its active-exploitation (KEV) status.
!Escalate to CISO/legal if privileged credential compromise or lateral movement from the host is identified.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

>Windows Error Reporting (WER) crash dumps and ReportArchive entries for the faulting Windows module
>Application event log EventCode 1000 records naming the faulting application and module
>Sysmon/EDR process-creation records linking the crashed service to an anomalous child process

Tuning Guidance

Build a per-environment allowlist of legitimate SYSTEM-context automation (SCCM/Intune, backup and monitoring agents) that spawn shells from service processes, and exclude those parent/child/command-line combinations. Tighten confidence by requiring correlation with a nearby crash event (EventCode 1000) where crash telemetry is reliably collected, and consider raising severity to critical on servers exposed to untrusted input.

Hunting Queries

Baselines which child processes are normally spawned by core Windows service processes so anomalies from CVE-2026-85880 exploitation stand out.

Hunting — KQL

kql

DeviceProcessEvents | where InitiatingProcessFileName in~ ("svchost.exe","services.exe","lsass.exe","spoolsv.exe") | where InitiatingProcessIntegrityLevel in~ ("System","High") | summarize count() by FileName, InitiatingProcessFileName, DeviceName | order by count_ desc

Hunting — SPL

spl

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*svchost.exe" OR ParentImage="*services.exe" OR ParentImage="*lsass.exe") | stats count by Image, ParentImage, host

Atomic Red Team Tests

Test 1 Simulate privileged service spawning a shell

windows

Uses PsExec to launch cmd.exe as SYSTEM to emulate the post-exploitation footprint of a heap overflow in a privileged Windows service.

Command

powershell

psexec.exe -accepteula -s -i cmd.exe /c "whoami > C:\Windows\Temp\cve_2026_85880_test.txt"

Cleanup

powershell

del C:\Windows\Temp\cve_2026_85880_test.txt

Expected Telemetry

ProcessRollup2 / DeviceProcessEvents record showing cmd.exe spawned at SYSTEM integrity from a service context.

Expected Detection

KQL and CQL rules flag the System-integrity shell launch from a service parent.

Test 2 Generate an application crash event

windows

Forces a benign application crash to produce a WER dump and EventCode 1000 record, exercising the crash-correlation logic.

Command

powershell

powershell -c "$p = Start-Process notepad -PassThru; Start-Sleep 2; Stop-Process -Id $p.Id -Force; [void](Add-Type -MemberDefinition 'public static void C(){throw new System.AccessViolationException();}' -Name X -Namespace Y -PassThru)"

Cleanup

powershell

Remove-Item "$env:LOCALAPPDATA\Microsoft\Windows\WER\ReportArchive\*" -Recurse -Force -ErrorAction SilentlyContinue

Expected Telemetry

Application event log EventCode 1000 and a WER crash dump for the faulting process.

Expected Detection

SPL and QRadar rules match the EventCode 1000 crash event within the correlation window.

Test 3 LOLBin spawned from service context

windows

Runs rundll32.exe from a SYSTEM service context to emulate code execution following memory corruption.

Command

powershell

sc create cve85880test binPath= "cmd.exe /c rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL" start= demand & sc start cve85880test

Cleanup

powershell

sc stop cve85880test & sc delete cve85880test

Expected Telemetry

Process-creation telemetry showing rundll32.exe launched from a service (services.exe) parent at SYSTEM integrity.

Expected Detection

Elastic EQL, Chronicle YARA-L and CrowdStrike CQL rules flag the LOLBin spawned from a privileged service parent.

Related Detections

Tactic Hubs

TA0004Privilege Escalation TA0002Execution

Related Techniques

T1068Exploitation for Privilege Escalation T1203Exploitation for Client Execution

Detect CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-85880

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-85880

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Privilege Escalation

Popular Detections

Get new detections in your inbox