Critical Windows IKE Extension RCE Now Actively Exploited: CISA KEV Detection and Remediation Guide

---
title: IKEEXT Service Spawning Suspicious Child Process
id: 3f8c1a92-7b44-4e6d-9c21-5a8e2d6f4b07
status: experimental
description: Detects child processes spawned by the svchost instance hosting the IKEEXT service. IKEEXT does not legitimately spawn command interpreters, script engines, or LOLBins; this is a high-fidelity indicator of successful exploitation of the IKE Extension RCE.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains: 'IKEEXT'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; investigate any hit as probable compromise
level: critical
---
title: IKEEXT Service Crash or Unexpected Stop
id: 8e2d6f41-1c39-4b85-a7d4-9f3c5e8a2b61
status: experimental
description: Detects crashes or unexpected terminations of the IKEEXT service, which may indicate failed exploitation attempts against the IKE Extension memory corruption vulnerability. Correlates with Application Error / Service Control Manager telemetry.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: service_crash
  product: windows
detection:
  selection:
    ServiceName:
      - 'IKEEXT'
      - 'IKE and AuthIP IPsec Keying Modules'
  condition: selection
falsepositives:
  - Rare IPsec stack instability; cluster hits against inbound UDP 500/4500 anomalies before dismissing
level: high
---
title: Inbound IKE Traffic from Untrusted Source
id: 5b4a9e17-6d28-4f93-b1c7-2e8a3d5f9c40
status: experimental
description: Detects inbound UDP 500/4500 connections where the IKEEXT service is listening, from sources outside known IPsec peer ranges. Tune the exclusion list to your authorized VPN peers and site-to-site tunnel endpoints.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1046
logsource:
  category: firewall
  product: windows
detection:
  selection:
    DestinationPort:
      - 500
      - 4500
    Protocol: 'udp'
    Action: 'allow'
  filter_known_peers:
    SourceIP|cidr:
      - '10.0.0.0/8'  # REPLACE: authorized VPN peer ranges only
  condition: selection and not filter_known_peers
falsepositives:
  - Legitimate road-warrior VPN clients if the host is a VPN gateway; scope this rule to non-VPN roles (DCs, member servers, workstations)
level: high

// Hunt: child processes spawned from the svchost instance hosting IKEEXT
// Highest-fidelity signal for successful IKE Extension RCE exploitation
let ikeHosts = DeviceProcessEvents
| where InitiatingProcessCommandLine has "IKEEXT"
| summarize by DeviceId, InitiatingProcessId, TimeGenerated;
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| join kind=inner ikeHosts on $left.ProcessId == $right.InitiatingProcessId and $left.DeviceId == $right.DeviceId
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","net.exe","whoami.exe")
   or ProcessCommandLine has_any ("Invoke-","IEX","downloadstring","EncodedCommand","-enc ")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;
// Secondary hunt: inbound UDP 500/4500 to hosts not designated as VPN gateways
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort in (500, 4500) and Protocol == "Udp"
| where RemoteIPType == "Public" or not(RemoteIP startswith "10.")
| summarize ConnectionCount = count(), DistinctSources = dcount(RemoteIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, LocalPort
| order by DistinctSources desc;

-- Hunt: identify hosts with IKEEXT running, its svchost PID, suspicious children, and UDP 500/4500 listeners
-- Deploy fleet-wide via Velociraptor hunt to scope exposure and compromise simultaneously
LET ike_svchost <= SELECT Pid, Name, CommandLine, Username
FROM pslist()
WHERE Name =~ 'svchost' AND CommandLine =~ 'IKEEXT'

SELECT 'IKEEXT_SERVICE' AS Finding,
       Pid, CommandLine, Username,
       NULL AS ChildProcess, NULL AS LocalAddress, NULL AS RemoteAddress
FROM ike_svchost
UNION ALL
SELECT 'SUSPICIOUS_CHILD' AS Finding,
       p.Pid, p.CommandLine, p.Username,
       p.Name AS ChildProcess, NULL, NULL
FROM pslist() AS p
WHERE p.Ppid IN (SELECT Pid FROM ike_svchost)
UNION ALL
SELECT 'IKE_LISTENER' AS Finding,
       n.Pid, NULL, NULL, NULL,
       n.Laddr AS LocalAddress, n.Raddr AS RemoteAddress
FROM netstat() AS n
WHERE n.Laddr =~ ':500$|:4500$' OR n.Status =~ 'LISTEN' AND n.Laddr =~ ':(500|4500)$'

# Verify IKEEXT exposure, patch state, and apply compensating firewall controls
# Run elevated. Review output before enforcing in production.

# 1. Enumerate IKEEXT status fleet-wide (run on each host or via your RMM/Intune)
$ike = Get-Service -Name IKEEXT -ErrorAction SilentlyContinue
Write-Output "[$env:COMPUTERNAME] IKEEXT Status: $($ike.Status) StartType: $($ike.StartType)"

# 2. Check which svchost is hosting IKEEXT (useful for triage correlation)
Get-CimInstance Win32_Service -Filter "Name='IKEEXT'" | Select-Object Name, State, ProcessId, PathName

# 3. Confirm listening state on UDP 500/4500
Get-NetUDPEndpoint -LocalPort 500,4500 -ErrorAction SilentlyContinue | Format-Table LocalAddress, LocalPort, OwningProcess

# 4. Verify patch level - compare against the current cumulative update from the MSRC advisory for this CVE
$os = Get-CimInstance Win32_OperatingSystem
Write-Output "Build: $($os.BuildNumber).$((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR)"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

# 5. COMPENSATING CONTROL: block inbound IKE/AuthIP from non-VPN-peer sources
# ONLY on hosts that are NOT functioning as VPN gateways or IPsec tunnel endpoints.
# Populate $TrustedPeers with your authorized site-to-site/remote-access peer ranges first.
$TrustedPeers = @("203.0.113.0/24")  # REPLACE with your real VPN peer CIDRs
New-NetFirewallRule -DisplayName "Block Inbound IKE - Non-Trusted Sources (UDP 500)" `
  -Direction Inbound -Protocol UDP -LocalPort 500 -RemoteAddress Any -Action Block -Profile Any -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "Block Inbound IKE - Non-Trusted Sources (UDP 4500)" `
  -Direction Inbound -Protocol UDP -LocalPort 4500 -RemoteAddress Any -Action Block -Profile Any -ErrorAction SilentlyContinue
# Then explicitly allow only trusted peers (rule precedence: place above the block via rule groups)
New-NetFirewallRule -DisplayName "Allow Inbound IKE - Trusted VPN Peers Only" `
  -Direction Inbound -Protocol UDP -LocalPort 500,4500 -RemoteAddress $TrustedPeers -Action Allow -Profile Any -ErrorAction SilentlyContinue

# 6. Disable IKEEXT ONLY after confirming no IPsec/VPN dependency (test in staging first)
# Set-Service IKEEXT -StartupType Disabled; Stop-Service IKEEXT -Force