CVE-2026-21410 & Supply Chain Attacks: Exchange Zero-Day, npm Worms, and AI Poisoning

---
title: Potential Exchange CVE-2026-21410 Web Shell Activity
id: 8a4b1c92-3d5e-4f6a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects suspicious command-line execution spawned by the Microsoft Exchange IIS worker process (w3wp.exe), indicative of web shell activity or RCE exploitation.
references:
  - https://www.microsoft.com/security/blog/
author: Security Arsenal
date: 2026/05/05
tags:
  - attack.initial_access
  - attack.t1190
  - attack.webshell
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'Exchange Server'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'certutil'
      - 'bitsadmin'
  condition: all of selection_*
falsepositives:
  - Legitimate Exchange administrative scripts (rare)
level: critical
---
title: npm Malicious Package Post-Install Script Execution
id: 9b5c2d03-4e6f-5g7a-0c2d-3e4f5a6b7c8d
status: experimental
description: Detects suspicious command execution by Node.js immediately following an npm install, typical of dependency supply chain attacks.
references:
  - https://npmjs.com/advisories
author: Security Arsenal
date: 2026/05/05
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_npm:
    Image|endswith: '\node.exe'
    CommandLine|contains: 'postinstall'
  selection_suspicious_cmds:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'curl'
      - 'base64'
      - 'echo'  # often used to write files
  condition: all of selection_*
falsepositives:
  - Legitimate build scripts using network requests
level: high
---
title: AI Research Environment Credential Theft
id: 0c6d3e14-5f7g-6h8b-1d3e-4f5g6a7b8c9e
status: experimental
description: Detects processes (often Python or Git) attempting to access sensitive credential files (.env, .aws, id_rsa) in user directories, consistent with the Fake AI Repo stealer.
references:
  - https://thehackernews.com/2026/05/weekly-recap.html
author: Security Arsenal
date: 2026/05/05
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\.env'
      - '\credentials'
      - '\.aws'
      - '\id_rsa'
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\git.exe'
      - '\node.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate developer tooling accessing config files
level: medium

// Hunt for Exchange Web Shell Activity and Suspicious Child Processes
let ExchangeProcesses = DeviceProcessEvents
| where InitiatingProcessFileName == "w3wp.exe"
| where InitiatingProcessCommandLine contains "Exchange";
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where InitiatingProcessProcessId in (ExchangeProcesses | distinct ProcessId)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;

// Hunt for npm Supply Chain Suspicions
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName == "node.exe"
| where ProcessCommandLine contains "postinstall"
| extend ParentProcess = InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(1d)
    | where InitiatingProcessFileName == "node.exe"
) on DeviceName, $left.ProcessId == $right.InitiatingProcessProcessId
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, ProcessCommandLine;

// Hunt for Suspicious Node.js Parent-Child Relationships and AI Stealer File Access
SELECT 
  p.Pid as ParentPid,
  p.Name as ParentName,
  c.Pid as ChildPid,
  c.Name as ChildName,
  c.CommandLine as ChildCmd,
  f.FullPath as AccessedFile
FROM pslist(p=True)
LEFT JOIN foreach(row=
    SELECT * FROM pslist(parent_pid=Pid)
) AS c
LEFT JOIN foreach(row=
    SELECT * FROM glob(globs="/**/.env", root=proc_info(p.Pid).cwd) 
) AS f
WHERE p.Name = "node.exe" AND c.CommandLine =~ "postinstall"
   OR (p.Name IN ("python.exe", "git.exe") AND f.FullPath =~ "\.env$")

<#
    .SYNOPSIS
    Response and Hardening Script for Exchange Zero-Day and Supply Chain Threats
    .DESCRIPTION
    1. Checks for suspicious w3wp.exe child processes.
    2. Audits npm packages for unusual postinstall scripts.
    3. Removes suspicious AI model files.
#>

# Check for Suspicious Exchange Processes
Write-Host "[*] Checking for suspicious Exchange IIS worker process children..."
$suspiciousProcs = Get-WmiObject Win32_Process | Where-Object { 
    $_.ParentProcessId -in (Get-Process -Name w3wp -ErrorAction SilentlyContinue).Id -and 
    $_.Name -in ('cmd.exe', 'powershell.exe') 
}

if ($suspiciousProcs) {
    Write-Host "[!] ALERT: Suspicious processes found:" -ForegroundColor Red
    $suspiciousProcs | Select-Object Name, ProcessId, CommandLine | Format-Table
    # Kill process (Action required review)
    # $suspiciousProcs | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
} else {
    Write-Host "[+] No suspicious w3wp children detected." -ForegroundColor Green
}

# Audit NPM Package Integrity (Quick Check for recent installs)
Write-Host "[*] Scanning for recently modified node_modules..."
$basePath = "C:\Users" # Adjust based on your dev environment
$recentModules = Get-ChildItem -Path $basePath -Filter "package." -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }

if ($recentModules) {
    Write-Host "[!] WARNING: Recent package changes detected. Review manually:" -ForegroundColor Yellow
    $recentModules | Select-Object FullName, LastWriteTime
} else {
    Write-Host "[+] No recent suspicious npm activity." -ForegroundColor Green
}

# Check for common AI Stealer drop locations
Write-Host "[*] Checking for malicious AI model dropzones..."
$aiPaths = @("$env:USERPROFILE\Downloads\model_weights", "$env:APPDATA\AI_Models")
foreach ($path in $aiPaths) {
    if (Test-Path $path) {
        Write-Host "[!] Found AI directory: $path" -ForegroundColor Yellow
        Get-ChildItem $path -Recurse | Select-Object Name, Length
    }
}