CVE-2026-55040

Sentinel/Defender KQL

DeviceLogonEvents
| where InitiatingProcessCommandLine contains "CVE-2026-55040.py" or InitiatingProcessCommandLine contains "--target" and InitiatingProcessCommandLine contains "--x5t"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, RemoteIP, RemotePort
// Further behavioral detection for SharePoint specific logs (e.g., IIS logs, SharePoint ULS logs) for unusual admin activity after a potential bypass.
// Example (requires SharePoint logs ingested):
// SharePointLogs
// | where Message contains "Authentication bypass" or Message contains "JWT token validation failure" or (UserPrincipalName == "" and Operation contains "Admin")
// | project TimeGenerated, Computer, Message, UserPrincipalName, Operation, SourceIPAddress

Splunk SPL

(sourcetype="ms:sharepoint:uls" OR sourcetype="iis:access:log") (("Authentication bypass" OR "JWT token validation failure") OR (NOT _exists_("user") AND "admin"))
| table _time, host, source, sourcetype, user, action, ip_address, message
// For process-level detection if an exploit script is run on a server:
// index=os (process="python" AND (command="*CVE-2026-55040.py*" OR command="*--target* --x5t*"))
// | table _time, host, user, process, command

Sigma

title: SharePoint JWT Auth Bypass Exploit Attempt
id: <generate_new_guid>
status: experimental
description: Detects potential exploitation attempts of CVE-2026-55040, a JWT authentication bypass in Microsoft SharePoint.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
    CommandLine|contains:
      - 'CVE-2026-55040.py'
      - '--target'
      - '--x5t'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - User
  - Image
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.55040
level: high
---
title: SharePoint Unusual Admin Activity After Auth Bypass
id: <generate_new_guid>
status: experimental
description: Detects unusual administrative activity in SharePoint logs that might indicate a successful authentication bypass (CVE-2026-55040).
references:
  - https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/
logsource:
  category: webserver
  product: sharepoint
detection:
  selection:
    # Example for SharePoint ULS logs or similar
    Message|contains:
      - 'Authentication bypass'
      - 'JWT token validation failure'
    # Or, administrative actions from unauthenticated/unknown users
    # This requires specific log fields for user and operation
    # User|startswith: '' # Empty user field
    # Operation|contains: 'Admin'
  condition: selection
fields:
  - Message
  - User
  - Operation
  - SourceIPAddress
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.55040
level: high

Elastic ES|QL

FROM process WHERE process.executable : ("*\\python.exe", "*\\pythonw.exe") AND process.command_line : ("*CVE-2026-55040.py*", "*--target*", "*--x5t*")
// Further behavioral detection for SharePoint specific logs
// FROM logs-sharepoint-* WHERE message : ("Authentication bypass", "JWT token validation failure") OR (NOT @metadata.user AND message : "Admin")
// SELECT @timestamp, host.name, message, user.name, source.ip