CVE-2026-40372: ASP.NET Core Privilege Escalation — Detection, Patching, and Verification Guide

---
title: ASP.NET Core Suspicious Unsigned DLL Load
id: 82e4a123-5b67-4c89-9e10-1f2a3b4c5d6e
status: experimental
description: Detects ASP.NET Core processes (dotnet.exe) loading unsigned DLLs from user-writable paths, potentially exploiting CVE-2026-40372 to bypass signature checks.
references:
  - https://msrc.microsoft.com/advisory
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - '\dotnet.exe'
      - '\w3wp.exe'
    Signed: 'false'
  filter_legit:
    ImageLoaded|contains:
      - '\Windows\Microsoft.NET\'
      - '\Program Files\'
  condition: selection and not filter_legit
falsepositives:
  - Legacy application plugins without signatures
level: high
---
title: ASP.NET Process Spawning Shell
id: 93f5b234-6c78-4d90-0f21-2g3h4i5j6k7l
status: experimental
description: Detects the dotnet process spawning cmd.exe or powershell.exe, typical post-exploitation behavior after privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\dotnet.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrative troubleshooting
level: high

// Hunt for unsigned DLLs loaded by ASP.NET processes
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("dotnet.exe", "w3wp.exe")
| where IsSigned == false
| where FolderPath !contains @"C:\Windows\Microsoft.NET\" 
   and FolderPath !contains @"C:\Program Files\"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| order by Timestamp desc

-- Hunt for ASP.NET processes with unsigned modules
SELECT Pid, Name, Exe, CommandLine
FROM pslist()
WHERE Name =~ "dotnet" OR Name =~ "w3wp"
SELECT * FROM foreach(
    SELECT Pid FROM pslist() WHERE Name =~ "dotnet" OR Name =~ "w3wp"
)
SELECT *
FROM process_loader(pid=Pid)
WHERE SignedStatus != "SIGNED"
LIMIT 10

# PowerShell script to validate ASP.NET Core versions and check for patch status
# Note: Replace 'TargetPatchVersion' with the specific version required by Microsoft's advisory.

$TargetPatchVersion = "9.0.2" # Example version, verify against official advisory
$Vulnerable = $false

Write-Host "[+] Checking installed ASP.NET Core Runtimes..." -ForegroundColor Cyan

# Get list of runtimes using dotnet --list-runtimes
try {
    $runtimes = & dotnet --list-runtimes 2>&1
    if ($LASTEXITCODE -eq 0) {
        foreach ($line in $runtimes) {
            if ($line -match "Microsoft.AspNetCore.App\s+(\d+\.\d+\.\d+)") {
                $version = [version]$Matches[1]
                Write-Host "Found: Microsoft.AspNetCore.App $version" -ForegroundColor White
                
                # Basic version check logic (Adjust as per specific OOB update requirements)
                if ($version -lt [version]$TargetPatchVersion) {
                    Write-Host "[ALERT] Vulnerable version detected: $version" -ForegroundColor Red
                    $Vulnerable = $true
                } else {
                    Write-Host "[OK] Version $version appears patched." -ForegroundColor Green
                }
            }
        }
    }
} catch {
    Write-Host "[-] .NET CLI not found or error checking runtimes." -ForegroundColor Yellow
}

if ($Vulnerable) {
    Write-Host "[!] ACTION REQUIRED: Apply Microsoft OOB Update for CVE-2026-40372 immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No vulnerable runtimes detected based on defined threshold." -ForegroundColor Green
}