CVE-2026-41089: Windows Netlogon Critical RCE — Detection and Remediation Guide

---
title: Suspicious Process Spawned by Lsass (Netlogon Context)
id: 8a5f2c11-1d2e-4f3a-9b8c-1d2f3b4c5d6e
status: experimental
description: Detects potential exploitation of a Netlogon RCE vulnerability by monitoring for suspicious child processes spawned by lsass.exe, which hosts the Netlogon service.
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.privilege_escalation
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\lsass.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_legit:
    # Filter out known legitimate scanners if necessary, though lsass spawning cmd is rare
    User: 'NT AUTHORITY\SYSTEM'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate debugging by authorized administrators (rare)
level: critical
---
title: Netlogon Service Crash or Unexpected Stop
id: 9b6g3d22-2e3f-5g4a-0c9d-2e3g4c5d6e7f
status: experimental
description: Detects unexpected termination or restart of the Netlogon service, which may indicate a failed exploit attempt or buffer overflow crash.
references:
  - https://support.microsoft.com/en-us/topic/overview-of-netlogon-service-4e7c9367-6c8a-4b8e-8c3e-1d3f4b5c6d7e
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7031 # Service Control Manager: Service terminated unexpectedly
    Provider_Name: 'Service Control Manager'
    ImagePath|contains: 'Netlogon'
  condition: selection
falsepositives:
  - Rare service instability due to network failures
level: high

// Hunt for suspicious child processes spawned by lsass.exe (Netlogon context)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "lsass.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "bash.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256
| order by Timestamp desc

// Check for Netlogon Service Crashes (Event ID 7031)
Event
| where Timestamp > ago(7d)
| where EventID == 7031
| extend RenderedDescription = tostring(RenderedDescription)
| where RenderedDescription contains "Netlogon"
| project Timestamp, Computer, RenderedDescription, EventData
| order by Timestamp desc

-- Hunt for processes spawned by lsass.exe which may indicate successful RCE
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name = "lsass.exe")
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")

-- Check Netlogon Service Status
SELECT Name, Status, Pid, BinaryPath
FROM win_service_info()
WHERE Name = "Netlogon"

<#
.SYNOPSIS
    Audit and Remediation Script for CVE-2026-41089 (May 2026 Patch Tuesday)
.DESCRIPTION
    This script checks for the installation of the May 2026 security updates
    relevant to CVE-2026-41089 and verifies the Netlogon service status.
#>

# Define hypothetical patch IDs for May 2026 (Replace with actual KBs upon release)
# This script checks for updates installed after the Patch Tuesday release date.
$PatchTuesdayDate = Get-Date "2026-05-12"

Write-Host "[+] Checking for patches installed after May 2026 Patch Tuesday..." -ForegroundColor Cyan

try {
    $Hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -gt $PatchTuesdayDate }
    
    if ($Hotfixes) {
        Write-Host "[+] Found recent security updates:" -ForegroundColor Green
        $Hotfixes | Format-Table HotFixID, InstalledOn, Description -AutoSize
    } else {
        Write-Host "[!] No patches found installed after $PatchTuesdayDate." -ForegroundColor Red
        Write-Host "[!] Please ensure the May 2026 Cumulative Update is applied immediately." -ForegroundColor Red
    }
} catch {
    Write-Host "[!] Error retrieving hotfix information: $_" -ForegroundColor Red
}

# Verify Netlogon Service State
Write-Host "\n[+] Verifying Netlogon Service State..." -ForegroundColor Cyan
$Netlogon = Get-Service -Name Netlogon -ErrorAction SilentlyContinue

if ($Netlogon) {
    Write-Host "Status: $($Netlogon.Status)"
    Write-Host "StartType: $($Netlogon.StartType)"
    
    if ($Netlogon.Status -ne 'Running') {
        Write-Host "[!] WARNING: Netlogon service is not running." -ForegroundColor Yellow
    }
} else {
    Write-Host "[!] WARNING: Could not query Netlogon service." -ForegroundColor Red
}

# Check for unusual lsass.exe child processes (Immediate check)
Write-Host "\n[+] Checking for suspicious child processes of lsass.exe..." -ForegroundColor Cyan
$lsass = Get-WmiObject Win32_Process -Filter "name='lsass.exe'"
if ($lsass) {
    $children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $lsass.ProcessId }
    if ($children) {
        Write-Host "[!] ALERT: Found child processes spawned by lsass.exe:" -ForegroundColor Red
        $children | Select-Object Name, ProcessId, CommandLine | Format-Table -AutoSize
    } else {
        Write-Host "[+] No suspicious child processes detected." -ForegroundColor Green
    }
}