CVE-2026-42897: Microsoft Exchange Zero-Day Exploitation — Detection and Mitigation Guide

---
title: Potential Exchange RCE via Suspicious w3wp.exe Child Process
id: 4a1f9b2c-3d4e-4f5a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects potential remote code execution against Microsoft Exchange by identifying w3wp.exe spawning suspicious shells (cmd, powershell, csc).
references:
  - https://msrc.microsoft.com/advisory
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\csc.exe'
      - '\vbc.exe'
  filter:
    # Filter out legitimate monitoring if necessary, though usually w3wp should not spawn these
    User|contains:
      - 'MSExchange'
      - 'IUSR'
condition: selection_parent and selection_child
falsepositives:
  - Legacy management scripts running via IIS
level: critical
---
title: Web Shell Creation in Exchange Directories
id: 5b2a0c1d-4e5f-5a6b-0c9d-2e3f4a5b6c7d
status: experimental
description: Detects creation of potential web shells in known Exchange web directories.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - 'C:\\inetpub\\wwwroot\\'
      - 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\'
      - 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\ClientAccess\\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
  filter_legit:
    Image|contains: 'w3wp.exe' # Legitimate IIS process creating compiled files, usually handled by attribute filters, but context matters
  condition: selection_paths and selection_ext
falsepositives:
  - Exchange software updates
  - Legitimate administrator activity
level: high

// Hunt for suspicious processes spawned by IIS Worker Process (w3wp.exe)
// Relevant for DeviceProcessEvents (Defender for Endpoint) or SecurityEvent (if Sysmon is configured)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where not(ProcessFileName in~("conhost.exe", "WerFault.exe", "rundll32.exe")) // Exclude noise, investigate others
| where ProcessFileName in~("cmd.exe", "powershell.exe", "pwsh.exe", "regsvr32.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for web shells and suspicious process lineage on Exchange servers
SELECT Pid, Ppid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Exe =~ "w3wp.exe"
   AND Pid IN (
       SELECT Ppid 
       FROM pslist()
       WHERE Name IN ("cmd.exe", "powershell.exe", "pwsh.exe")
   )

// Check for recently modified .aspx files in web roots
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:\\inetpub\\wwwroot\\**\\*.aspx")
WHERE Mtime > now() - 7d // Modified in the last 7 days

<#
.SYNOPSIS
    Exchange Server Audit and Temporary Mitigation Script for CVE-2026-42897
.DESCRIPTION
    Checks for signs of compromise (w3wp spawning shells) and helps disable vulnerable
    endpoints as per Microsoft's interim guidance.
#>

# Check for Suspicious Process Activity
Write-Host "[+] Checking for suspicious IIS worker process activity..." -ForegroundColor Cyan
$suspiciousProcs = Get-WmiObject Win32_Process | Where-Object { 
    $_.ParentProcessId -ne 0 -and 
    (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName -eq "w3wp.exe" -and 
    $_.Name -in @("cmd.exe", "powershell.exe", "pwsh.exe") 
}

if ($suspiciousProcs) {
    Write-Host "[!] ALERT: Suspicious child processes detected under w3wp.exe:" -ForegroundColor Red
    $suspiciousProcs | Format-Table Name, ProcessId, ParentProcessId, CommandLine
} else {
    Write-Host "[+] No suspicious shell activity detected." -ForegroundColor Green
}

# Audit Web Shells (Recently modified ASPX files)
Write-Host "[+] Checking for recently modified web shell candidates..." -ForegroundColor Cyan
$webPaths = @(
    "C:\inetpub\wwwroot",
    "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa",
    "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp"
)

$cutoffDate = (Get-Date).AddDays(-2)
foreach ($path in $webPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include *.aspx, *.ashx, *.asmx -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $cutoffDate } |
        ForEach-Object {
            Write-Host "[!] ALERT: Recent file detected: $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Yellow
        }
    }
}

# Apply Microsoft Mitigation (Example: Disabling vulnerable endpoint)
# WARNING: Verify this matches the specific CVE guidance from Microsoft.
# This is a generic template for disabling ECP if it is the vector.
Write-Host "[+] Implementing temporary mitigation (Please verify vendor guidance for CVE-2026-42897)..." -ForegroundColor Cyan
$ecpPath = "C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp"
if (Test-Path $ecpPath) {
    $backupPath = $ecpPath + ".bak_" + (Get-Date -Format "yyyyMMddHHmm")
    Write-Host "[*] Disabling ECP directory by renaming it to $backupPath" -ForegroundColor Yellow
    try {
        Rename-Item -Path $ecpPath -NewName $backupPath -ErrorAction Stop
        Write-Host "[+] Mitigation applied. ECP is disabled." -ForegroundColor Green
    } catch {
        Write-Host "[!] Failed to apply mitigation: $_" -ForegroundColor Red
    }
}