SecBoard
Zurück zur CVE-Übersicht

CVE-2026-106581

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 4.92.0

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "Docker Desktop Installer.exe"
| where ProcessCommandLine contains "install -package"
| where ProcessCommandLine contains ".exe" or ProcessCommandLine contains ".msi" // Look for execution of a package
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 NewProcessName="*Docker Desktop Installer.exe" CommandLine="*install -package*" CommandLine="*.exe*" OR CommandLine="*.msi*" | table _time, host, ParentProcessName, CommandLine, NewProcessName, ProcessPath

Sigma

title: Docker Desktop Installer Package Execution
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2026-106581 in Docker Desktop for Windows by monitoring for 'Docker Desktop Installer.exe' executing with the 'install -package' argument and an executable/MSI.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\Docker Desktop Installer.exe'
    CommandLine|contains: 'install -package'
    CommandLine|contains:
      - '.exe'
      - '.msi'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - Image
tags:
  - attack.privilege_escalation
  - cve.2026.106581

Elastic ES|QL

from process where event.type == "start" and process.executable.name == "Docker Desktop Installer.exe" and process.args contains "install -package" and (process.args contains ".exe" or process.args contains ".msi") | select @timestamp, host.name, process.parent.executable.name, process.command_line, process.executable.name, process.executable.path

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen