CVE-2026-85880

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "ALPC" and (ProcessCommandLine contains "overflow" or ProcessCommandLine contains "exploit") or (InitiatingProcessFileName == "lsass.exe" and FileName == "powershell.exe") // Beispiel: Überwachung von ungewöhnlichen Prozessen, die mit ALPC interagieren oder nach einer Privilegienerhöhung gestartet werden
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessCommandLine

Splunk SPL

(sourcetype=WinEventLog OR sourcetype=ms:defender:atp) (ALPC AND (overflow OR exploit)) OR (ParentProcessName="lsass.exe" AND ProcessName="powershell.exe") | table _time, host, ParentProcessName, ProcessName, CommandLine

Sigma

title: Windows ALPC Heap Buffer Overflow - Potential Exploitation
id: 9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation attempts of a heap-based buffer overflow in Windows ALPC leading to privilege escalation.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 
      - 'ALPC'
      - 'overflow'
      - 'exploit'
  condition: selection
falsepositives:
  - Legitimate software behavior (unlikely for 'exploit' keyword)
level: high

Elastic ES|QL

from process where process.command_line : "ALPC" and (process.command_line : "overflow" or process.command_line : "exploit") or (process.parent.name : "lsass.exe" and process.name : "powershell.exe") | select @timestamp, host.name, process.parent.name, process.name, process.command_line