CVE-2026-41091 and Legacy Windows: CISA KEV Alert on Microsoft Defender and Active Exploits

---
title: Potential Microsoft Defender Service Crash (DoS)
id: 8a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890
status: experimental
description: Detects unexpected termination of the Microsoft Defender service, indicative of a potential DoS attempt via CVE-2026-45498 or tampering.
references:
  - https://www.cisa.gov/news-events/alerts/2026/05/20/cisa-adds-seven-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  product: windows
  category: system
detection:
  selection:
    SourceName: 'Service Control Manager'
    EventID: 7031 # Service terminated unexpectedly
  filter_service:
    Message|contains:
      - 'WinDefend'
      - 'MsMpEng'
condition: selection and filter_service
falsepositives:
  - Legitimate driver updates causing service restart
level: high
---
title: Suspicious Modification of Defender Registry Keys
id: 9b3c4d5e-6f78-9012-3c4d-5e6f78901234
status: experimental
description: Detects modifications to Microsoft Defender registry keys often associated with privilege escalation or disabling protection (CVE-2026-41091).
references:
  - https://www.cisa.gov/news-events/alerts/2026/05/20/cisa-adds-seven-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.privilege_escalation
  - attack.t1548.002
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\Windows Defender\Features'
      - '\SOFTWARE\Microsoft\Windows Defender\Policy'
      - '\SOFTWARE\Policies\Microsoft\Windows Defender'
  filter_legit:
    Details|contains:
      - 'DisableAntiSpyware'
      - 'TamperProtection'
condition: selection
falsepositives:
  - Authorized administrator changes via GPO
level: medium
---
title: Legacy Windows SMB MS08-067 Exploitation Attempt
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects potential exploitation attempts of CVE-2008-4250 (MS08-067) via malformed RPC requests or unusual SMB behavior on legacy endpoints.
references:
  - https://www.cisa.gov/news-events/alerts/2026/05/20/cisa-adds-seven-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationPort: 445
    Image|endswith:
      - '\svchost.exe'
  condition: selection
falsepositives:
  - High volume of legitimate SMB file sharing
level: low

// Hunt for Microsoft Defender Service Crashes (DoS) and Tamper Attempts
union DeviceProcessEvents, DeviceEvents, SecurityEvent
| where Timestamp > ago(7d)
| where ( ActionType == "ServiceStopped" and InitiatingProcessFileName == "svchost.exe" and FileName in~ ("MsMpEng.exe", "WinDefend.exe") )
   or ( ActionType == "AntivirusTampering" )
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, FileName, AdditionalFields
| order by Timestamp desc

-- Hunt for unexpected termination of Defender services
SELECT 
  Timestamp, 
  System.TimeCreated as SystemTime, 
  System.Provider as EventProvider, 
  EventData.Data as ServiceName,
  EventID
FROM Windows.Evtx(path='C:\\Windows\\System32\\winevt\\Logs\\System.evtx')
WHERE EventID = 7031 AND ServiceName =~ 'WinDefend'

-- Check Registry for Tamper Protection Disabled
SELECT 
  FullPath, 
  Mtime, 
  Data.value
FROM glob(globs="C:\\Windows\\System32\\config\\SYSTEM")
JOIN parse_regkey(file=FullPath, key="\\SOFTWARE\\Microsoft\Windows Defender\Features")
WHERE Data.name =~ "TamperProtection" AND Data.value != 1

# Remediation Script for CISA KEV (May 2026)
# Checks for MS08-067 patch and verifies Defender Security Baseline

Write-Host "[+] Starting CISA KEV Remediation Check: May 2026" -ForegroundColor Cyan

# 1. Check for MS08-067 (CVE-2008-4250) - Patch KB958644
$hotfix = Get-HotFix -Id "KB958644" -ErrorAction SilentlyContinue
if (-not $hotfix) {
    Write-Host "[!] CRITICAL: System appears vulnerable to CVE-2008-4250 (MS08-067). Patch KB958644 not found." -ForegroundColor Red
    Write-Host "    Action: Isolate this host immediately. It likely belongs to a legacy OS (XP/2003)." -ForegroundColor Red
} else {
    Write-Host "[OK] Patch KB958644 found. Vulnerability MS08-062 mitigated." -ForegroundColor Green
}

# 2. Verify Defender Tamper Protection (Mitigation for CVE-2026-41091)
try {
    $tamperPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
    $tamperStatus = (Get-ItemProperty -Path $tamperPath -ErrorAction Stop).TamperProtection
    if ($tamperStatus -ne 1) {
        Write-Host "[!] WARNING: Defender Tamper Protection is disabled/enforceable. Risk of Privilege Escalation (CVE-2026-41091)." -ForegroundColor Yellow
        Write-Host "    Action: Enable Tamper Protection via Intune or Group Policy." -ForegroundColor Yellow
    } else {
        Write-Host "[OK] Defender Tamper Protection is Enabled." -ForegroundColor Green
    }
} catch {
    Write-Host "[!] Could not verify Defender Registry Keys." -ForegroundColor Yellow
}

# 3. Check Defender Service Status (Mitigation for CVE-2026-45498)
$defenderService = Get-Service -Name "WinDefend" -ErrorAction SilentlyContinue
if ($defenderService.Status -ne "Running") {
    Write-Host "[!] CRITICAL: Microsoft Defender Service is not running. Possible DoS (CVE-2026-45498) or manual stop." -ForegroundColor Red
    Write-Host "    Action: Restart service and investigate Event Logs for crashes." -ForegroundColor Red
} else {
    Write-Host "[OK] Microsoft Defender Service is running." -ForegroundColor Green
}

Write-Host "[+] Remediation Check Complete." -ForegroundColor Cyan