CVE-2026-42897: Microsoft Exchange Server Exploitation — Detection and Remediation Guide

---
title: Potential Exchange Exploitation - W3WP Spawning Shell
id: 8a4b2c1d-9e6f-4a3b-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects Microsoft Exchange (w3wp.exe) spawning cmd.exe, powershell.exe, or other shells, a common post-exploitation behavior for RCE chains.
references:
 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.initial_access
 - attack.t1190
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\w3wp.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
     - '\wmic.exe'
   # Filter out legitimate Exchange management if necessary, though rare from w3wp
 filter:
   CommandLine|contains:
     - 'bin\SearchAdmin'
     - 'bin\Managed\'
condition: selection and not filter
falsepositives:
 - Legitimate administrative scripts executed via web interfaces (rare)
level: critical
---
title: Suspicious ASPX File Creation in Exchange Directories
id: 9b5c3d2e-0f7a-5b4c-9d6e-2f3a4b5c6d7e
status: experimental
description: Detects creation of ASPX or ASMX files in Exchange Front-end web directories, indicative of web shell deployment.
references:
 - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.persistence
 - attack.webshell
 - attack.t1505.003
logsource:
 category: file_create
 product: windows
detection:
 selection:
   TargetFilename|contains:
     - '\Exchange Server\ClientAccess\Owa\'
     - '\Exchange Server\ClientAccess\ecp\'
   TargetFilename|endswith:
     - '.aspx'
     - '.asmx'
   CreationTime:
     - date: 2026/04/01  # Adjust date window as needed for alerting
falsepositives:
 - Official Exchange Updates or legitimate custom web parts (very rare)
level: high

// Hunt for Exchange IIS Worker Process spawning suspicious utilities
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessId
| extend ProcessCommandLineHex = tostring(base64_encode(tostring(ProcessCommandLine))) // Optional for obfuscation analysis
| order by Timestamp desc

-- Hunt for w3wp.exe (Exchange) spawning suspicious shells
SELECT Pid as PID,
       Name as ProcessName,
       CommandLine,
       Username,
       Parent.Pid as ParentPID,
       Parent.Name as ParentName,
       Parent.CommandLine as ParentCmd
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name =~ "cmd.exe" OR Name =~ "powershell.exe" OR Name =~ "pwsh.exe"

# Check Exchange Server Version for CVE-2026-42897 Compliance
# Run elevated on Exchange Server

Write-Host "[+] Checking Exchange Server Version..." -ForegroundColor Cyan

$ExchangeInstallPath = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup").MsiInstallPath
$ExchangeBinPath = Join-Path $ExchangeInstallPath "Bin"
$exsetupexe = Join-Path $ExchangeBinPath "exsetup.exe"

if (Test-Path $exsetupexe) {
    $fileVersion = (Get-Command $exsetupexe).FileVersionInfo.FileVersion
    Write-Host "Current Exchange Build: $fileVersion" -ForegroundColor Yellow
    
    # Placeholder: Update this value with the patched version from MSRC
    $SecureBuild = "15.02.XXXX.XXX" 

    if ($fileVersion -lt $SecureBuild) {
        Write-Host "[!] VULNERABLE: Build $fileVersion is older than the secure build $SecureBuild." -ForegroundColor Red
        Write-Host "[+] Action Required: Apply the latest Cumulative Update immediately." -ForegroundColor Red
    } else {
        Write-Host "[+] SECURE: Build appears patched against CVE-2026-42897." -ForegroundColor Green
    }
} else {
    Write-Host "[-] Error: Could not find exsetup.exe. Are you on an Exchange Server?" -ForegroundColor Red
}