CVE-2026-119952

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName =~ "lsass.exe" or InitiatingProcessFileName =~ "schannel.dll" // Adjust based on specific Schannel process/module
| where RemotePort == 445 or RemotePort == 3389 // Common ports for network communication potentially involving Schannel
| summarize RequestCount = count() by bin(Timestamp, 1s), RemoteIP, RemotePort
| where RequestCount > 100 // Look for unusually high request counts in short intervals, indicative of timing attacks
| project Timestamp, RemoteIP, RemotePort, RequestCount
| extend Anomaly = "Potential Schannel Timing Discrepancy Exploitation"

Splunk SPL

index=* (process_name=lsass.exe OR process_name=schannel.dll) (dest_port=445 OR dest_port=3389)
| bucket span=1s _time
| stats count as RequestCount by _time, dest_ip, dest_port
| where RequestCount > 100
| table _time, dest_ip, dest_port, RequestCount
| rename _time as Timestamp, dest_ip as RemoteIP, dest_port as RemotePort
| eval Anomaly = "Potential Schannel Timing Discrepancy Exploitation"

Sigma

title: Windows Schannel Timing Discrepancy
id: 7a0b3c1d-2e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects potential exploitation of CVE-2026-119952 by observing unusual network timing discrepancies related to Schannel.
author: SecBoard
date: 2026/11/10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-119952
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    InitiatingProcessFileName|endswith:
      - 'lsass.exe'
      - 'schannel.dll'
    DestinationPort:
      - 445
      - 3389
  timeframe: 1s
  condition: selection | count() > 100
fields:
  - InitiatingProcessFileName
  - DestinationIp
  - DestinationPort
falsepositives:
  - Legitimate high-volume network activity (requires tuning)
level: high

Elastic ES|QL

from network_connection
| where process.executable.name == "lsass.exe" or process.executable.name == "schannel.dll"
| where destination.port == 445 or destination.port == 3389
| bucket span=1s @timestamp
| summarize RequestCount = count() by @timestamp, destination.ip, destination.port
| where RequestCount > 100
| project @timestamp, destination.ip, destination.port, RequestCount
| append { generate_value(Anomaly, "Potential Schannel Timing Discrepancy Exploitation") }