SecBoard
Zurück zur CVE-Übersicht

CVE-2026-107090

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution logic

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for local privilege escalation attempts via executable search-path hijacking, specifically looking for suspicious execution of 'msiexec.exe' from non-standard or user-controlled directories.

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "msiexec.exe"
| where FolderPath !startswith "C:\\Windows\\System32\\" and FolderPath !startswith "C:\\Windows\\SysWOW64\\"
| where InitiatingProcessFileName =~ "MaltegoSetup.JRE64.v4.13.0.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 NewProcessName="*\\msiexec.exe" ParentProcessName="*\\MaltegoSetup.JRE64.v4.13.0.exe" NOT (NewProcessName="C:\\Windows\\System32\\msiexec.exe" OR NewProcessName="C:\\Windows\\SysWOW64\\msiexec.exe") | table _time, Host, ParentProcessName, NewProcessName, CommandLine

Sigma

title: Maltego Installer Search-Path Hijacking
status: experimental
description: Detects potential executable search-path hijacking attempts involving the Maltego Windows Installer (v4.13.0) by monitoring for 'msiexec.exe' execution from unusual paths.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\MaltegoSetup.JRE64.v4.13.0.exe'
    Image|endswith: '\msiexec.exe'
  filter:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection and not filter
fields:
  - Image
  - ParentImage
  - CommandLine
tags:
  - attack.privilege_escalation
  - cve.2026.107090
  - cwe.427

Elastic ES|QL

FROM process WHERE event.action == "process_started" AND process.parent.executable == "MaltegoSetup.JRE64.v4.13.0.exe" AND process.executable == "msiexec.exe" AND NOT (process.args : ("C:\\Windows\\System32\\msiexec.exe", "C:\\Windows\\SysWOW64\\msiexec.exe")) SELECT @timestamp, host.name, process.parent.executable, process.executable, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • e9916461fcbf4d9f159356feedf5416a27ea7ae634deeb09aa50c425b4dd7919

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen