CVE-2026-4670 & CVE-2026-5174: MOVEit Automation Critical Vulnerabilities — Detection and Hardening Guide

---
title: MOVEit Automation Spawning Windows Shell
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects MOVEit Automation process (java.exe or MoveITDMZ.exe) spawning cmd.exe or powershell.exe, indicative of post-exploitation activity.
references:
  - https://securityaffairs.com/191681/security/moveit-automation-flaws-could-enable-full-system-compromise.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\java.exe' # MOVEit Automation often runs on Java
      - 'MoveITAutomation.exe'
      - 'MoveITDMZ.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative debugging (rare)
level: high
---
title: Suspicious Network Connections from MOVEit Automation
id: 1b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects MOVEit Automation processes initiating outbound connections to non-standard ports or suspicious IPs, potentially indicating C2 beaconing.
references:
  - https://securityaffairs.com/191681/security/moveit-automation-flaws-could-enable-full-system-compromise.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - 'java.exe'
      - 'MoveITAutomation.exe'
    Initiated: 'true'
    DestinationPort|notin:
      - '80'
      - '443'
      - '22'
      - '21'
  condition: selection
falsepositives:
  - Legitimate file transfers to non-standard partner ports
level: medium

// Hunt for suspicious process creation by MOVEit Automation
// Looks for java.exe (hosting MOVEit) spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in (~"java.exe", "MoveITAutomation.exe", "MoveITDMZ.exe")
| where FileName in (~"cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

-- Velociraptor VQL to hunt for MOVEit Automation process anomalies
-- Identifies processes where the parent is the MOVEit service and the child is a shell
SELECT Parent.Name as ParentName, Parent.Pid as ParentPid, Name as ChildName, Pid, CommandLine, Username
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = Ppid
WHERE Parent.Name =~ "java" OR Parent.Name =~ "MoveIT"
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe")

# Remediation Script: Check MOVEit Automation Service Status
# Note: This script checks for the service. Verify specific patch versions in vendor advisory.
$serviceName = "MOVEit Automation"
$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue

if ($service) {
    Write-Host "[+] Found Service: $($service.DisplayName)"
    Write-Host "    Status: $($service.Status)"
    Write-Host "    Start Type: $($service.StartType)"
    Write-Host ""
    Write-Host "[ACTION REQUIRED]: Ensure you have applied the latest patches for CVE-2026-4670 and CVE-2026-5174."
    Write-Host "Refer to the official Progress Software advisory for the specific Build Number required."
    
    # Get process details if running
    if ($service.Status -eq 'Running') {
        $process = Get-WmiObject -Class Win32_Process -Filter "Name='java.exe' OR Name='MoveITAutomation.exe'"
        if ($process) {
            Write-Host "    Process Path: $($process.ExecutablePath)"
            Write-Host "    Process ID: $($process.ProcessId)"
            Write-Host "    Please verify the file version of the executable against the vendor advisory."
        }
    }
} else {
    Write-Host "[-] MOVEit Automation service not found on this host."
}