CVE-2026-88164

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "cmd.exe")
| where InitiatingProcessFileName =~ "w3wp.exe" // SharePoint w3wp.exe process
| where ProcessCommandLine has_any ("net user", "add user", "group add", "sc create", "schtasks /create") // Common privilege escalation commands
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=ms:o365:audit)
| search (process_name IN ("powershell.exe", "cmd.exe") AND parent_process_name="w3wp.exe") OR (event_type="SharePoint" AND operation="Add-User" OR operation="Add-Group")
| search (command_line IN ("net user", "add user", "group add", "sc create", "schtasks /create"))
| table _time, host, process_name, parent_process_name, command_line, user

Sigma

title: SharePoint Privilege Escalation via Process Spawn
id: 00000000-0000-0000-0000-000000000000 # Placeholder - generate a unique GUID
status: experimental
description: Detects suspicious process creation by SharePoint w3wp.exe indicative of privilege escalation.
author: SecBoard
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection

Elastic ES|QL

FROM process WHERE event.action == "start" AND process.parent.executable == "w3wp.exe" AND process.executable IN ("powershell.exe", "cmd.exe") AND process.command_line : ("net user", "add user", "group add", "sc create", "schtasks /create")