CVE-2026-103572: Visual Studio Copilot and SSMS Unauthenticated Code Execution — Detection and Remediation Guide

---
title: Visual Studio or SSMS Spawning Command Interpreter - Possible Copilot Containment Escape
description: Detects Visual Studio (devenv.exe) or SQL Server Management Studio (Ssms.exe) spawning command interpreters, script hosts, or LOLBins, consistent with post-exploitation following a Copilot arbitrary command execution primitive such as CVE-2026-103572.
id: 8f2c1a94-3b7e-4d61-9c05-2e7a6b48f1d3
status: experimental
author: Security Arsenal
date: 2026/02/11
references:
  - https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
  - https://attack.mitre.org/techniques/T1059/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\devenv.exe'
      - '\Ssms.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tasks, pre/post-build events, and SSMS external tools can spawn cmd.exe or powershell.exe. Baseline per-developer and alert on new parent/child pairs.
level: high
---
title: Copilot Configuration File Modification Outside Installer Context
description: Detects non-installer processes writing to GitHub Copilot settings and configuration files under user profile and application data directories, consistent with the path validation bypass in CVE-2026-103572 where Copilot is induced to overwrite its own configuration to escape containment.
id: 4d7e2b61-9a3c-4f58-b702-6c1d8e95a3f4
status: experimental
author: Security Arsenal
date: 2026/02/11
references:
  - https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
  - https://attack.mitre.org/techniques/T1554/
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Microsoft\VisualStudio\'
      - '\AppData\Roaming\Microsoft\VisualStudio\'
      - '\AppData\Local\GitHubCopilot\'
      - '\.vs\'
      - '\github-copilot\'
      - '\copilot'
  selection_ext:
    TargetFilename|endswith:
      - '.json'
      - '.config'
      - '.xml'
      - '.settings'
  filter_installers:
    Image|endswith:
      - '\VSIXInstaller.exe'
      - '\setup.exe'
      - '\vs_installer.exe'
      - '\msiexec.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Visual Studio itself updates settings on configuration changes. Tune by correlating with the Image field and alert when the writing process is a Copilot child process or an unexpected binary.
level: medium

// Hunt: Visual Studio / SSMS spawning script hosts or shells (possible Copilot containment escape - CVE-2026-103572)
let lookback = 14d;
let ideParents = dynamic(["devenv.exe", "Ssms.exe", "copilot", "Microsoft.VisualStudio.Copilot"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe", "curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any (ideParents)
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, ProcessId, InitiatingProcessId, SHA256
| order by TimeGenerated desc;

// Hunt: Unexpected writes to Copilot / Visual Studio configuration files by non-IDE processes
let lookback = 14d;
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has_any ("GitHubCopilot", "github-copilot", "copilot")
   or (FolderPath has "VisualStudio" and FolderPath has "Settings")
| where FileName endswith ".json" or FileName endswith ".config" or FileName endswith ".xml"
| where InitiatingProcessFileName !in~ ("devenv.exe", "VSIXInstaller.exe", "vs_installer.exe", "msiexec.exe", "MsMpEng.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, FolderPath, ActionType, SHA256
| order by TimeGenerated desc;

-- Hunt: Copilot containment escape artifacts (CVE-2026-103572)
-- Part 1: IDE-spawned shells/script hosts currently or recently running
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin)\.exe$'
  AND (
    SELECT Name FROM pslist(pid=Ppid)
  ) =~ '(?i)(devenv|ssms|copilot)'

-- Hunt: Recently modified Copilot configuration files (potential self-config overwrite)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/GitHubCopilot/**/*.json',
  'C:/Users/*/AppData/Roaming/GitHub Copilot/**/*.json',
  'C:/Users/*/.copilot/**/*.json',
  'C:/Users/*/AppData/Local/Microsoft/VisualStudio/**/copilot*'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

# CVE-2026-103572 - Verify Visual Studio / SSMS patch state and audit Copilot config integrity
# Run elevated on developer and DBA workstations. Test in a pilot OU before broad deployment.

# 1) Enumerate installed Visual Studio instances and versions
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
if (Test-Path $vswhere) {
    & $vswhere -all -products * -format json | ConvertFrom-Json |
        Select-Object displayName, installationVersion, installationPath, updateDate |
        Format-List
} else {
    Write-Warning "vswhere.exe not found - Visual Studio may not be installed."
}

# 2) Check for pending Visual Studio updates via the installer
$vsInstaller = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vs_installer.exe"
if (Test-Path $vsInstaller) {
    Write-Host "[ACTION] Launch Visual Studio Installer and apply the latest security update for your channel (addresses CVE-2026-103572)." -ForegroundColor Yellow
}

# 3) Enumerate SSMS installations
$ssmsPaths = @(
    "${env:ProgramFiles(x86)}\Microsoft SQL Server Management Studio*",
    "$env:ProgramFiles\Microsoft SQL Server Management Studio*"
)
foreach ($p in $ssmsPaths) {
    Get-ChildItem $p -Filter Ssms.exe -Recurse -ErrorAction SilentlyContinue |
        Select-Object FullName, @{n='FileVersion';e={$_.VersionInfo.ProductVersion}} | Format-List
}

# 4) Audit Copilot configuration files for unexpected recent modification (possible self-config overwrite)
$cutoff = (Get-Date).AddDays(-14)
$auditPaths = @(
    "$env:LOCALAPPDATA\GitHubCopilot",
    "$env:APPDATA\GitHub Copilot",
    "$env:USERPROFILE\.copilot"
)
foreach ($path in $auditPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -Include *.json,*.config,*.xml -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff } |
            Select-Object FullName, LastWriteTime, Length |
            Sort-Object LastWriteTime -Descending | Format-Table -AutoSize
    }
}

# 5) Baseline: record hashes of Copilot config files for future integrity comparison
$baselineOut = "$env:ProgramData\SecOps\CopilotConfigBaseline_$(Get-Date -Format yyyyMMdd).csv"
New-Item -ItemType Directory -Path (Split-Path $baselineOut) -Force | Out-Null
foreach ($path in $auditPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -Include *.json,*.config,*.xml -ErrorAction SilentlyContinue |
            ForEach-Object {
                [PSCustomObject]@{
                    Path = $_.FullName
                    Hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                    LastWriteTime = $_.LastWriteTime
                }
            } | Export-Csv $baselineOut -Append -NoTypeInformation
    }
}
Write-Host "Baseline written to $baselineOut" -ForegroundColor Green