SecBoard
Zurück zur CVE-Übersicht

CVE-2026-83598

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • v2.10.4

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "-NoProfile" and ProcessCommandLine contains "-ExecutionPolicy Bypass" and ProcessCommandLine contains "-NonInteractive"
| where InitiatingProcessFileName =~ "msiexec.exe" or InitiatingProcessCommandLine contains "msiexec.exe"
| where AccountName == "NT AUTHORITY\SYSTEM"
| where ProcessCommandLine contains "Microsoft.PowerShell_profile.ps1"

Splunk SPL

index=windows_events (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=WinEventLog:Security EventCode=4688)
| where (CommandLine LIKE "%-NoProfile%" AND CommandLine LIKE "%-ExecutionPolicy Bypass%" AND CommandLine LIKE "%-NonInteractive%")
| where (ParentProcessName="msiexec.exe" OR ParentCommandLine LIKE "%msiexec.exe%")
| where User="NT AUTHORITY\\SYSTEM"
| where CommandLine LIKE "%Microsoft.PowerShell_profile.ps1%"

Sigma

title: Netdata Agent MSI Repair Privilege Escalation
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential privilege escalation via Netdata Agent MSI repair by monitoring PowerShell execution as SYSTEM without -NoProfile.
author: SecBoard
date: 2026/09/02
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-NoProfile'
      - '-ExecutionPolicy Bypass'
      - '-NonInteractive'
    ParentImage|endswith: '\msiexec.exe'
    User: 'NT AUTHORITY\\SYSTEM'
    CommandLine|contains: 'Microsoft.PowerShell_profile.ps1'
  condition: selection
level: high

Elastic ES|QL

from process where process.executable : "*\\powershell.exe" and process.command_line : "*-NoProfile*" and process.command_line : "*-ExecutionPolicy Bypass*" and process.command_line : "*-NonInteractive*" and process.parent.executable : "*\\msiexec.exe" and user.name : "NT AUTHORITY\\SYSTEM" and process.command_line : "*Microsoft.PowerShell_profile.ps1*"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Sonstige (1)

  • %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen