CISA KEV Alert: CVE-2026-65400 macOS Authentication Bypass Actively Exploited Alongside SharePoint, vCenter, and Microsoft IKE Flaws — Detection and Remediation Guide

---
title: macOS Authentication Daemon Spawning Shell or Interpreter
id: 3f8c2a71-9b4d-4e6a-b1c7-2d5e8f0a3b6c
status: experimental
description: Detects macOS authentication or directory service daemons spawning shells or scripting interpreters, consistent with post-exploitation activity following an authentication bypass such as CVE-2026-65400.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/05
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/authd'
      - '/securityd'
      - '/loginwindow'
      - '/opendirectoryd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
      - '/python'
      - '/python3'
      - '/osascript'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; MDM agent misconfigurations may trigger review
level: high
---
title: macOS LaunchDaemon or LaunchAgent Persistence Created by Suspicious Process
id: 8a1e4b62-7c3f-4d58-a9e2-1b6c4d7e0f2a
status: experimental
description: Detects creation of LaunchDaemon or LaunchAgent plist files by non-installer processes, a common persistence mechanism following macOS compromise including exploitation of CVE-2026-65400.
references:
  - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/08/05
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchDaemons/'
      - '/Library/LaunchAgents/'
      - '/LaunchAgents/'
  selection_ext:
    TargetFilename|endswith: '.plist'
  filter_installers:
    Image|endswith:
      - '/installer'
      - '/softwareupdated'
      - '/packagekitd'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Legitimate enterprise software deployment outside MDM channels
level: high
---
title: SharePoint IIS Worker Process Spawning Command Shell
id: 5c2d7f91-4a8b-4e36-b3d1-9f0a2c5e7b84
status: experimental
description: Detects the SharePoint IIS worker process spawning command shells, PowerShell, or the C# compiler, strongly indicative of webshell deployment or in-memory execution following SharePoint exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/08/05
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\csc.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy SharePoint solutions invoke command-line tools — verify against deployment records
level: critical

// Part 1: SharePoint w3wp spawning shells + IKEEXT anomalies on Windows
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (InitiatingProcessFileName =~ "w3wp.exe"
        and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "csc.exe", "net.exe", "whoami.exe"))
        or (InitiatingProcessFileName =~ "svchost.exe"
        and InitiatingProcessCommandLine has "IKEEXT"
        and FileName !in~ ("svchost.exe", "rasmans.dll"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName,
          ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Part 2: macOS syslog telemetry (via Sentinel Syslog/CEF ingestion) —
// auth daemons spawning interpreters and Keychain access anomalies
Syslog
| where TimeGenerated > ago(14d)
| where Facility == "auth" or ProcessName in~ ("authd", "securityd", "loginwindow", "security")
| where SyslogMessage has_any ("bash", "zsh", "osascript", "dump-keychain", "find-generic-password")
   or (ProcessName =~ "security" and SyslogMessage has "keychain")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

-- Hunt for recent persistence and webshell artifacts across the fleet
-- macOS LaunchDaemon/LaunchAgent plists modified in the last 14 days
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=2048) AS PlistHead
FROM glob(globs=['/Library/LaunchDaemons/*.plist',
                 '/Library/LaunchAgents/*.plist',
                 '/Users/*/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Windows: ASPX files written to SharePoint LAYOUTS in the last 14 days (webshell triage)
SELECT FullPath, Mtime, Size
FROM glob(globs=['C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/*.aspx',
                 'C:/inetpub/wwwroot/wss/VirtualDirectories/*/_layouts/**/*.aspx'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Windows: processes spawned by w3wp (SharePoint worker process)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'w3wp'
   OR CommandLine =~ 'w3wp.exe'

# --- Windows: SharePoint + IKE verification and triage ---

# 1. Confirm installed updates (cross-reference against Microsoft's current security update GUIDE for the KEV-listed fixes)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 |
  Format-Table HotFixID, Description, InstalledOn

# 2. Check for recently written ASPX files in SharePoint LAYOUTS (webshell triage)
$cutoff = (Get-Date).AddDays(-14)
$layouts = "C:\Program Files\Common Files\microsoft shared\Web Server Extensions"
if (Test-Path $layouts) {
  Get-ChildItem -Path $layouts -Recurse -Filter *.aspx -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } |
    Select-Object FullName, LastWriteTime, Length
}

# 3. Audit IKEEXT service health — repeated crashes/restarts may indicate exploitation attempts
Get-EventLog -LogName System -Source "Service Control Manager" -After $cutoff |
  Where-Object { $_.Message -match "IKEEXT" } |
  Select-Object TimeGenerated, EntryType, Message | Format-List

# 4. Confirm IKEEXT is not disabled where IPsec is in use, and capture its current state
Get-Service IKEEXT | Select-Object Name, Status, StartType

# --- macOS (run via MDM or ssh): build check + persistence triage ---
# Execute the Bash block below on macOS endpoints

# --- macOS: CVE-2026-65400 verification and triage ---

# 1. Capture current macOS version and build — compare against Apple's security release notes
#    for the build that remediates CVE-2026-65400; any build older than the patched release is vulnerable
sw_vers

# 2. Enumerate LaunchDaemons/LaunchAgents modified in the last 14 days for persistence triage
find /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents \
  -name "*.plist" -mtime -14 -exec ls -la {} \; 2>/dev/null

# 3. Check for pending Apple security updates and install them immediately
softwareupdate --list
# sudo softwareupdate --install --all --restart

# 4. Review recent authentication anomalies in the unified log (last 24 hours)
log show --last 24h --predicate 'process == "authd" OR process == "securityd"' \
  --style compact 2>/dev/null | grep -iE "fail|error|denied" | tail -50