CVE-2026-118148

Sentinel/Defender KQL

IdentityDirectoryEvents
| where ActionType == "UserAccountControlModified"
| where AdditionalFields contains "UserAccountControl: 0x0200" // ACCOUNTDISABLE flag removed
| where InitiatingProcessName !~ "lsass.exe" // Filter out legitimate system processes
| project TimeGenerated, ActionType, TargetAccountDisplayName, TargetAccountSid, InitiatingProcessName, InitiatingProcessCommandLine, SourceIPAddress, AdditionalFields, DeviceName

Splunk SPL

sourcetype="ActiveDirectory" (eventtype="user-account-modified" OR eventtype="group-membership-modified") NOT (user="*$" OR user="DWM-*" OR user="LOCAL SERVICE" OR user="NETWORK SERVICE")
| where not (match(_raw, "UserAccountControl: 0x0200") AND match(_raw, "InitiatingProcessName: lsass.exe"))
| table _time, eventtype, user, dest, object, attribute, old_value, new_value

Sigma

title: Active Directory Privilege Elevation Attempt
status: experimental
description: Detects attempts to elevate privileges in Active Directory by modifying user account control attributes.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118148
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4738 # A user account was changed
        AttributeLDAPDisplayName: "userAccountControl"
        AttributeValue|contains: "512" # ACCOUNTDISABLE removed (or similar privilege-granting change)
    filter:
        SubjectLogonId: "0x3e7" # Filter out SYSTEM account changes if not relevant
    condition: selection and not filter
fields:
    - SubjectUserName
    - TargetUserName
    - MemberName
    - MemberSid
    - AttributeLDAPDisplayName
    - AttributeValue
tags:
    - attack.privilege_escalation
    - attack.t1078.002
    - cve.2026.118148

Elastic ES|QL

FROM logs-windows.security-*
| WHERE event.code == 4738 AND winlog.event_data.AttributeLDAPDisplayName == "userAccountControl" AND winlog.event_data.AttributeValue : "*512*"
| WHERE NOT winlog.event_data.SubjectLogonId == "0x3e7"
| SELECT @timestamp, winlog.event_data.SubjectUserName, winlog.event_data.TargetUserName, winlog.event_data.AttributeLDAPDisplayName, winlog.event_data.AttributeValue, host.name