Detect CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation in CrowdStrike LogScale
Detects exploitation attempts and post-exploitation activity associated with CVE-2026-85880, a heap-based buffer overflow (CWE-122) with use of uninitialized resource (CWE-908) in Microsoft Windows. Listed in the CISA KEV catalog (disclosed 2026-09-08), this vulnerability is actively exploited to achieve memory corruption leading to elevation of privilege or remote code execution. Detection focuses on process crash telemetry (WER/faulting module), anomalous child processes spawned from Windows components, suspicious memory operations, and privilege-escalation indicators following a crash, since no public PoC or specific affected-version list is available and exploitation manifests primarily as crash-then-execute behavior.
MITRE ATT&CK
- Tactic
- Privilege Escalation Execution
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(svchost|services|lsass|spoolsv)\.exe$/i
| ImageFileName=/\\(cmd|powershell|rundll32|regsvr32|mshta|wscript)\.exe$/i
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName], function=([count(as=cnt), collect([CommandLine])]))
| sort(cnt, order=desc)CrowdStrike CQL query flagging privileged Windows service processes spawning shells or LOLBins, consistent with CVE-2026-85880 exploitation on managed hosts.
Data Sources
Required Tables
False Positives & Tuning
- SYSTEM-context scheduled tasks launching shells
- RMM and deployment tooling spawning LOLBins from services
- Security tooling launching helper processes from privileged services
Other platforms for CVE-2026-85880
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate privileged service spawning a shell
Expected signal: ProcessRollup2 / DeviceProcessEvents record showing cmd.exe spawned at SYSTEM integrity from a service context.
- Test 2Generate an application crash event
Expected signal: Application event log EventCode 1000 and a WER crash dump for the faulting process.
- Test 3LOLBin spawned from service context
Expected signal: Process-creation telemetry showing rundll32.exe launched from a service (services.exe) parent at SYSTEM integrity.
References (4)
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-85880
Response Playbook
Triage
- Confirm the alerting host is a Windows system and identify whether the parent service process (svchost/services/lsass/spoolsv) crashed shortly before the child process was spawned by reviewing WER and EventCode 1000 records.
- Determine the Windows build/patch level and cross-reference against the MSRC advisory for CVE-2026-85880 to confirm whether the host is missing the fix.
- Examine the spawned child process command line, parent lineage, and integrity level to assess whether execution occurred at System/High privilege.
- Check for concurrent authentication anomalies (new admin sessions, token manipulation) that would indicate successful privilege escalation.
Containment
- Isolate the affected host from the network via EDR containment to prevent lateral movement while preserving volatile evidence.
- Suspend or terminate the suspicious child process tree and disable any persistence (services, scheduled tasks, run keys) created after the crash.
- Force a credential reset for accounts that were active on the host, prioritizing privileged/service accounts if System-level execution is confirmed.
Evidence Collection
- Capture a full memory image and the WER crash dumps for the faulting Windows component before rebooting to preserve heap-corruption artifacts.
- Collect Sysmon/EDR process telemetry, Application event log crash records, and the child-process command lines and dropped files for the incident window.
- Export scheduled tasks, services, and autorun entries created or modified around the crash timestamp.
Escalation Criteria
- !Escalate to incident response immediately if child-process execution is confirmed at SYSTEM integrity following a service crash.
- !Escalate to threat-intel/vulnerability management if the host is confirmed unpatched against CVE-2026-85880 given its active-exploitation (KEV) status.
- !Escalate to CISO/legal if privileged credential compromise or lateral movement from the host is identified.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Error Reporting (WER) crash dumps and ReportArchive entries for the faulting Windows module - >
Application event log EventCode 1000 records naming the faulting application and module - >
Sysmon/EDR process-creation records linking the crashed service to an anomalous child process
Tuning Guidance
Build a per-environment allowlist of legitimate SYSTEM-context automation (SCCM/Intune, backup and monitoring agents) that spawn shells from service processes, and exclude those parent/child/command-line combinations. Tighten confidence by requiring correlation with a nearby crash event (EventCode 1000) where crash telemetry is reliably collected, and consider raising severity to critical on servers exposed to untrusted input.
Hunting Queries
Baselines which child processes are normally spawned by core Windows service processes so anomalies from CVE-2026-85880 exploitation stand out.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("svchost.exe","services.exe","lsass.exe","spoolsv.exe") | where InitiatingProcessIntegrityLevel in~ ("System","High") | summarize count() by FileName, InitiatingProcessFileName, DeviceName | order by count_ descindex=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*svchost.exe" OR ParentImage="*services.exe" OR ParentImage="*lsass.exe") | stats count by Image, ParentImage, hostAtomic Red Team Tests
Uses PsExec to launch cmd.exe as SYSTEM to emulate the post-exploitation footprint of a heap overflow in a privileged Windows service.
Command
psexec.exe -accepteula -s -i cmd.exe /c "whoami > C:\Windows\Temp\cve_2026_85880_test.txt"Cleanup
del C:\Windows\Temp\cve_2026_85880_test.txtExpected Telemetry
ProcessRollup2 / DeviceProcessEvents record showing cmd.exe spawned at SYSTEM integrity from a service context.
Expected Detection
KQL and CQL rules flag the System-integrity shell launch from a service parent.
Forces a benign application crash to produce a WER dump and EventCode 1000 record, exercising the crash-correlation logic.
Command
powershell -c "$p = Start-Process notepad -PassThru; Start-Sleep 2; Stop-Process -Id $p.Id -Force; [void](Add-Type -MemberDefinition 'public static void C(){throw new System.AccessViolationException();}' -Name X -Namespace Y -PassThru)"Cleanup
Remove-Item "$env:LOCALAPPDATA\Microsoft\Windows\WER\ReportArchive\*" -Recurse -Force -ErrorAction SilentlyContinueExpected Telemetry
Application event log EventCode 1000 and a WER crash dump for the faulting process.
Expected Detection
SPL and QRadar rules match the EventCode 1000 crash event within the correlation window.
Runs rundll32.exe from a SYSTEM service context to emulate code execution following memory corruption.
Command
sc create cve85880test binPath= "cmd.exe /c rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL" start= demand & sc start cve85880testCleanup
sc stop cve85880test & sc delete cve85880testExpected Telemetry
Process-creation telemetry showing rundll32.exe launched from a service (services.exe) parent at SYSTEM integrity.
Expected Detection
Elastic EQL, Chronicle YARA-L and CrowdStrike CQL rules flag the LOLBin spawned from a privileged service parent.