CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: SharePoint Server Active Exploitation — Detection and Hardening

---
title: Potential SharePoint RCE - W3WP Spawning Shell
id: a1b2c3d4-5678-90ef-gh12-34567890ijkl
status: experimental
description: Detects w3wp.exe (SharePoint/IIS worker process) spawning cmd.exe or powershell.exe, indicative of web shell or RCE activity related to CVE-2026-32201, CVE-2026-45659, or CVE-2026-56164.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
  - cve-2026-32201
  - cve-2026-45659
  - cve-2026-56164
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: IIS MachineKeys Access by SharePoint Worker Process
id: b2c3d4e5-6789-01f2-hi34-56789012jklm
status: experimental
description: Detects unusual access to the IIS MachineKeys directory by the w3wp.exe process. Attackers stealing machine keys is a key TTP in the active SharePoint exploitation campaign.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1003
  - cve-2026-32201
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith: '\w3wp.exe'
    TargetFilename|contains: '\MachineKeys\'
  condition: selection
falsepositives:
  - Rare; legitimate SharePoint operations usually do not read MachineKeys directly via w3wp in this manner.
level: high


**KQL (Microsoft Sentinel / Defender):**

// Hunt for w3wp.exe spawning shells or accessing MachineKeys
let ProcessSpawn = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256;
let FileAccess = DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FolderPath contains @"\MachineKeys\"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, SHA256;
union ProcessSpawn, FileAccess


**Velociraptor VQL:**

-- Hunt for w3wp.exe accessing MachineKeys or spawning shells
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'w3wp.exe'
  AND (CommandLine =~ 'MachineKeys' OR Exe =~ 'MachineKeys')

-- Check for recent modifications in MachineKeys directory
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs='C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*')
WHERE Mtime < now() - 24h


**Remediation Script (PowerShell):**

# Audit SharePoint Server for Indicators of Compromise related to CVE-2026-32201
# Checks for recent modifications to IIS MachineKeys and suspicious w3wp child processes.

$MachineKeyPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys"
$HoursToCheck = 24

Write-Host "[+] Checking for modifications in $MachineKeyPath in last $HoursToCheck hours..."
$ModifiedKeys = Get-ChildItem -Path $MachineKeyPath -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-$HoursToCheck) }

if ($ModifiedKeys) {
    Write-Host "[!] WARNING: Found recently modified Machine Keys:" -ForegroundColor Red
    $ModifiedKeys | Select-Object FullName, LastWriteTime, Length
} else {
    Write-Host "[+] No recent MachineKey modifications detected." -ForegroundColor Green
}

Write-Host "[+] Checking for w3wp.exe spawning suspicious processes..."
$SuspiciousParents = @('cmd.exe', 'powershell.exe', 'pwsh.exe')
$Processes = Get-WmiObject -Class Win32_Process | Where-Object { 
    $_.ParentProcessId -ne 0 -and 
    $_.Name -in $SuspiciousParents
}

foreach ($proc in $Processes) {
    $parent = Get-WmiObject -Class Win32_Process | Where-Object { $_.ProcessId -eq $proc.ParentProcessId }
    if ($parent.Name -eq 'w3wp.exe') {
        Write-Host "[!] WARNING: w3wp.exe (PID $($parent.ProcessId)) spawned $($proc.Name) (PID $($proc.ProcessId))" -ForegroundColor Red
        Write-Host "    Command: $($proc.CommandLine)"
    }
}

Write-Host "[+] Audit complete. Apply Microsoft Security Updates for July 2026 immediately if IoCs found."