CVE-2026-121742: Ashlar-Vellum Cobalt XE File Parsing Use-After-Free — Detection and Mitigation Guide

---
title: Ashlar-Vellum Cobalt XE Parser Exploitation — Suspicious Child Process
id: 8f3a2b41-7c9d-4e5a-b1f8-2d4c6e8a9f01
status: experimental
description: Detects Cobalt spawning unexpected child processes, consistent with UAF exploitation leading to code execution.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-874/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Cobalt.exe'
      - '\Cobalt3D.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — Cobalt does not typically spawn system utilities
level: high
---
title: XE File Execution from Temp or Download Directories
id: 3b7c9d2e-5f1a-4e8b-a6d3-1c5e7f9b2d04
status: experimental
description: Identifies execution of XE files from user-writable directories, a common delivery vector for weaponized CAD files.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-874/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '.xe'
    CommandLine|contains:
      - '\Downloads\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\Desktop\'
  filter_legitimate:
    CommandLine|contains:
      - 'C:\\Program Files\\Ashlar-Vellum\\'
  condition: selection and not filter_legitimate
falsepositives:
  - Users legitimately opening XE files from Downloads (tune for environment)
level: medium
---
title: Cobalt Process Memory Anomaly — Potential UAF Artifact
id: 9e4f7a2c-1b8d-4f6a-c3e5-7d9b2f4a6e08
status: experimental
description: Detects abnormal memory allocation patterns in Cobalt process, potentially indicating UAF exploitation attempts.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-874/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith:
      - '\Cobalt.exe'
      - '\Cobalt3D.exe'
    GrantedAccess|contains:
      - '0x1F0FFF'
      - '0x1FFFFF'
    SourceImage|endswith:
      - '\Cobalt.exe'
      - '\Cobalt3D.exe'
  condition: selection
falsepositives:
  - Debugging or crash analysis activity
level: medium

// Hunt for Cobalt process anomalies and suspicious XE file handling
// Requires DeviceProcessEvents and DeviceFileEvents ingestion

let suspiciousPaths = dynamic([@"\Downloads\", @"\Temp\", @"\AppData\Local\Temp\", @"\Desktop\"]);
let cobaltProcesses = dynamic([@"Cobalt.exe", @"Cobalt3D.exe"]);

// Detect Cobalt spawning system utilities
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ cobaltProcesses
| where FileName in~ (dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"]))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| extend AlertSeverity = "High";

// Detect XE file creation in suspicious locations followed by Cobalt execution
let xeFileEvents = DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName endswith ".xe"
| where FolderPath has_any (suspiciousPaths)
| project XECreatedTime = TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName;

xeFileEvents
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ cobaltProcesses
    | project CobaltRunTime = TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessFileName
) on DeviceName
| where CobaltRunTime between (XECreatedTime .. XECreatedTime + 5m)
| project DeviceName, XECreatedTime, CobaltRunTime, FileName, FolderPath, ProcessCommandLine
| extend AlertSeverity = "High";

// Detect network connections from Cobalt process (unexpected for CAD application)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ cobaltProcesses
| where RemotePort in (80, 443, 8080, 4444, 8443)
| where not(RemoteUrl has_any ("ashlar.com", "ashlar-vellum.com", "microsoft.com", "windowsupdate.com"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| extend AlertSeverity = "Medium";

-- Hunt for Cobalt process anomalies and XE file artifacts
-- Deploy as hunt across engineering workstation groups

SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    ParentPid,
    (SELECT Name FROM pslist(pid=ParentPid)) AS ParentName
FROM pslist()
WHERE Name =~ 'Cobalt'
   OR Exe =~ 'Cobalt'

// Identify XE files in user-writable directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    (SELECT Data FROM stat(filename=FullPath)) AS FileMetadata
FROM glob(globs=['C:/Users/*/Downloads/*.xe', 'C:/Users/*/Desktop/*.xe', 'C:/Users/*/AppData/Local/Temp/*.xe'])
WHERE Mtime > now() - 604800

// Check for suspicious network connections from Cobalt
SELECT 
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    State,
    (SELECT Exe FROM pslist(pid=Pid)) AS ProcessPath
FROM netstat()
WHERE Name =~ 'Cobalt'
   AND State =~ 'ESTABLISHED'

# CVE-2026-121742 — Ashlar-Vellum Cobalt Compensating Controls
# Run as Administrator on engineering workstations

# 1. Inventory Cobalt installations
$cobaltPaths = @(
    "${env:ProgramFiles}\Ashlar-Vellum\Cobalt*",
    "${env:ProgramFiles(x86)}\Ashlar-Vellum\Cobalt*"
)

$installedVersions = Get-ChildItem -Path $cobaltPaths -ErrorAction SilentlyContinue | 
    Select-Object FullName, @{N='Version';E={$_.VersionInfo.FileVersion}}

if ($installedVersions) {
    Write-Warning "Cobalt installations detected — vulnerable until vendor patch released:"
    $installedVersions | Format-Table -AutoSize
} else {
    Write-Output "No Cobalt installations found in standard paths."
}

# 2. Enable Windows Defender Exploit Guard (ASR) rules for Office and script abuse
# Note: These are generic hardening — no Cobalt-specific ASR rules exist yet
$asrRules = @(
    @{Id="D4F940AB-401B-4EFC-AADC-AD5F3C50688A"; Name="Block all Office applications from creating child processes"},
    @{Id="3B576869-A4EC-4529-8536-B80A7769E899"; Name="Block Office applications from creating executable content"},
    @{Id="75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84"; Name="Block Office applications from injecting code into other processes"}
)

foreach ($rule in $asrRules) {
    try {
        Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Id -AttackSurfaceReductionRules_Actions Enabled -ErrorAction Stop
        Write-Output "Enabled ASR: $($rule.Name)"
    } catch {
        Write-Warning "Failed to enable ASR rule $($rule.Id): $_"
    }
}

# 3. Configure Windows Defender Application Control (WDAC) to restrict XE file execution
# Requires enterprise policy management — placeholder for organizational deployment
Write-Output "`nDeploy WDAC policy to restrict Cobalt.exe execution to approved directories only."
Write-Output "Block XE file associations for email clients and browsers."

# 4. Enable exploit protection mitigations for Cobalt (if installed)
$cobaltExe = Get-ChildItem -Path $cobaltPaths -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Name -match '^Cobalt' } | 
    Select-Object -First 1 -ExpandProperty FullName

if ($cobaltExe) {
    try {
        Set-ProcessMitigation -Name $cobaltExe -Enable DEP, BottomUp, SEHOP, ForceRelocateImages -ErrorAction Stop
        Write-Output "Enabled exploit mitigations for: $cobaltExe"
    } catch {
        Write-Warning "Failed to set mitigations: $_"
    }
}

# 5. Audit recent XE file access (last 7 days)
$xeFiles = Get-ChildItem -Path "$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:TEMP" -Filter "*.xe" -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastAccessTime -gt (Get-Date).AddDays(-7) }

if ($xeFiles) {
    Write-Warning "`nRecent XE file access detected — review for suspicious files:"
    $xeFiles | Select-Object FullName, LastAccessTime, @{N='SizeKB';E={[math]::Round($_.Length/1KB,2)}} | Format-Table -AutoSize
}

# 6. Block XE file execution via Software Restriction Policies (legacy but effective)
$srpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers"
if (-not (Test-Path $srpPath)) {
    New-Item -Path $srpPath -Force | Out-Null
    Set-ItemProperty -Path $srpPath -Name "DefaultLevel" -Value 0x40000
    Write-Output "Configured Software Restriction Policies — require explicit allow rules for XE execution"
}

Write-Output "`n=== Hardening Complete ==="
Write-Output "Monitor for Ashlar-Vellum security updates at: https://www.ashlar.com/support/"
Write-Output "ZDI Advisory: http://www.zerodayinitiative.com/advisories/ZDI-26-874/"