CVE-2026-64921

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "sharepoint" or FolderPath contains "sharepoint"
| where InitiatingProcessCommandLine contains "powershell" or InitiatingProcessCommandLine contains "cmd"
| where InitiatingProcessParentFileName == "w3wp.exe" // SharePoint Worker Process
| where not(InitiatingProcessLogonUserSid has_any ("S-1-5-18", "S-1-5-19", "S-1-5-20")) // Exclude system accounts if possible
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessLogonUserSid, InitiatingProcessLogonUserAccount, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine
| join kind=leftouter (
    DeviceNetworkEvents
    | where RemotePort == 80 or RemotePort == 443 // Assuming web traffic to SharePoint
    | where InitiatingProcessFileName contains "w3wp.exe"
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
) on DeviceName
| where isnotempty(RemoteIP) // Ensure network activity is present
| summarize count() by DeviceName, InitiatingProcessLogonUserAccount, InitiatingProcessCommandLine, RemoteIP
| where count_ > 5 // Adjust threshold for unusual activity
| extend Description = "Potenzieller unauthentifizierter Zugriff oder Privilegienerhöhung in SharePoint durch ungewöhnliche Prozessausführung oder Netzwerkkommunikation."

Splunk SPL

index=windows (sourcetype=XmlWinEventLog:Microsoft-Windows-SharePoint/Operational OR sourcetype=iis) 
| (EventCode=4624 OR EventCode=4625 OR EventCode=4672) OR (cs_uri_stem="/" AND sc_status=200 AND NOT user) // Look for successful/failed logins or unauthenticated access to critical functions
| search (NOT user=* AND cs_uri_stem IN ("*/_layouts/15/settings.aspx*", "*/_admin/*", "*/_vti_bin/*")) OR (EventCode=4672 AND NOT Account_Name IN ("SYSTEM", "NETWORK SERVICE")) // Example critical functions or privilege assignment
| stats count by host, user, src_ip, cs_uri_stem, EventCode, Message
| where count > 5 // Adjust threshold for unusual activity
| rename host as Host, user as User, src_ip as Source_IP, cs_uri_stem as URI_Stem, EventCode as Event_Code, Message as Event_Message
| eval Description = "Potenzieller unauthentifizierter Zugriff oder Privilegienerhöhung in SharePoint durch ungewöhnliche Zugriffe auf kritische Funktionen oder unautorisierte Privilegienzuweisung."

Sigma

title: SharePoint Missing Authentication for Critical Function
status: experimental
description: Detects potential exploitation of CVE-2026-64921 in Microsoft SharePoint, involving missing authentication for critical functions leading to privilege escalation.
references:
  - https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/
logsource:
  product: windows
  service: iis
  category: webserver
detection:
  selection:
    - cs_uri_stem|contains: # Example critical SharePoint paths
        - '/_layouts/15/settings.aspx'
        - '/_admin/'
        - '/_vti_bin/'
    - c_ip|is_not_in_private_range: true # Focus on external access
    - cs_username: null # Look for unauthenticated access
  condition: selection
fields:
  - c_ip
  - cs_uri_stem
  - cs_username
level: high

Elastic ES|QL

from logs-iis.*
| where url.path : ('/_layouts/15/settings.aspx*', '/_admin/*', '/_vti_bin/*')
| where client.ip !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)'
| where not has_field(user.name)
| stats count() by host.name, client.ip, url.path
| where count() > 5
| sort by count() desc
| append { from logs-windows.security.*
  | where event.code == 4672 // Privilege assigned to new logon
  | where not user.name in ('SYSTEM', 'NETWORK SERVICE')
  | stats count() by host.name, user.name, winlog.event_data.PrivilegeList
  | where count() > 5
  | sort by count() desc
}
| eval description = 'Potenzieller unauthentifizierter Zugriff oder Privilegienerhöhung in SharePoint durch ungewöhnliche Zugriffe auf kritische Funktionen oder unautorisierte Privilegienzuweisung.'