CVE-2026-32201: Microsoft SharePoint Zero-Day — Detection and Emergency Patching Guide

---
title: SharePoint Suspicious Child Process - CVE-2026-32201
id: 8a4b3c2d-1e9f-4a5b-8c6d-9e0f1a2b3c4d
status: experimental
description: Detects suspicious command-line utilities spawned by the SharePoint IIS worker process (w3wp.exe), indicative of web shell activity or exploitation of CVE-2026-32201.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.web_shell
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: '\Microsoft SharePoint Foundation\'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
  filter:
    User|contains: 'ADM' # Filter out specific admin accounts if strictly necessary, but use caution
condition: selection and not filter
falsepositives:
  - Legitimate administrative debugging (rare in production)
level: critical
---
title: SharePoint File Write Anomaly
id: 1b5c4d3e-2f0a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects creation of executable or script files within SharePoint web roots, a common tactic for persistence after RCE.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\wss\VirtualDirectories\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.config'
  filter_legit:
    Image|endswith: '\msdeploy.exe' # Exclude legitimate deployment tools
  condition: selection and not filter_legit
falsepositives:
  - Legitimate application deployment or updates
level: high

// Hunt for suspicious processes spawned by SharePoint IIS Worker Process
DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has "SharePoint"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| extend FullURL = parse_url(ProcessCommandLine)

-- Hunt for suspicious processes spawned by w3wp.exe indicating potential web shell execution
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCmd
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name =~ "cmd|powershell|pwsh|wscript|cscript"
  AND NOT (Exe =~ "C:\\Windows\\System32\\*")

# Check for April 2026 SharePoint Updates
# Note: Replace KB numbers below with specific KBs for SharePoint versions 2019/2022/Subscription when released by Microsoft

$ExpectedKBs = @("501XXXX", "501XXXX", "501XXXX") # Placeholder for actual April 2026 KBs
$SharePointInstalled = Get-HotFix | Where-Object { $_.Description -like "*SharePoint*" -or $_.HotFixID -in $ExpectedKBs }

if ($SharePointInstalled) {
    Write-Host "[+] SharePoint Security Updates for April 2026 appear to be installed." -ForegroundColor Green
    $SharePointInstalled | Format-Table HotFixID, InstalledOn
} else {
    Write-Host "[!] CRITICAL: April 2026 SharePoint Security Updates (CVE-2026-32201) NOT detected." -ForegroundColor Red
    Write-Host "[!] Apply patches immediately via Windows Update or Microsoft Update Catalog."
}

# Optional: Check for suspicious recent process creation by w3wp
$SuspiciousEvents = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]][EventData[Data[@Name='ParentProcessName']='C:\Windows\System32\inetsrv\w3wp.exe'] and Data[@Name='NewProcessName']='*\\cmd.exe' or Data[@Name='NewProcessName']='*\\powershell.exe']" -ErrorAction SilentlyContinue -MaxEvents 10

if ($SuspiciousEvents) {
    Write-Host "[!] WARNING: Detected recent suspicious command execution by w3wp.exe. Investigate potential compromise." -ForegroundColor Red
}