CVE-2026-55040: Unauthenticated SharePoint RCE Found by AI Agent — Detection, Hunting, and Patching Guide

---
title: IIS SharePoint Worker Process Spawning Command Interpreter
id: 3c8f4a21-7b2e-4d91-a6f3-9e1c5b8d2a47
status: experimental
description: Detects w3wp.exe (IIS worker process hosting SharePoint) spawning cmd.exe, powershell.exe, or other LOLBins. Strong indicator of post-exploitation following SharePoint RCE such as CVE-2026-55040.
references:
  - https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SharePoint timer jobs or custom solutions invoking scripts; baseline per farm and filter known-good command lines
level: high
---
title: Web Shell or ASPX File Written to SharePoint LAYOUTS Directory
id: 8d1e6b92-4c3f-4a85-b9d2-2f7a4e6c9b51
status: experimental
description: Detects creation or modification of .aspx/.ashx/.asmx files in SharePoint TEMPLATE\LAYOUTS or other web-served hive directories, consistent with web shell deployment after exploitation of CVE-2026-55040.
references:
  - https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\14\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\CONTROLTEMPLATES\'
      - '\Web Server Extensions\16\TEMPLATE\ADMIN\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
  condition: selection_path and selection_ext
falsepositives:
  - SharePoint solution (WSP) deployments and cumulative updates write legitimately; correlate with patch windows and change tickets
level: high
---
title: Suspicious Outbound Connection from SharePoint IIS Worker Process
id: 5b2c9d74-1e6a-4f38-a7c1-6d4b8e2f3a96
status: experimental
description: Detects w3wp.exe hosting SharePoint initiating outbound connections to rare external IPs, consistent with C2 or data exfiltration following SharePoint compromise via CVE-2026-55040.
references:
  - https://thehackernews.com/2026/08/researchers-disclose-ai-assisted.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\w3wp.exe'
    Initiated: 'true'
  filter_microsoft:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.microsoftonline.com'
      - '.sharepoint.com'
      - '.windows.net'
      - '.office.com'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not 1 of filter_*
falsepositives:
  - Hybrid SharePoint federation, search federation, and vendor integration calls; whitelist known SaaS endpoints per farm
level: medium

// Stage 1: SharePoint IIS worker process spawning command interpreters or recon tools
let SharePointServers = dynamic(["w3wp.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","whoami.exe","net.exe","nltest.exe","ipconfig.exe","systeminfo.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Stage 2: Web shell artifacts written into SharePoint hive directories
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("Web Server Extensions\\16\\TEMPLATE\\LAYOUTS","Web Server Extensions\\15\\TEMPLATE\\LAYOUTS","CONTROLTEMPLATES")
| where FileName endswith_cs ".aspx" or FileName endswith_cs ".ashx" or FileName endswith_cs ".asmx"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| order by TimeGenerated desc;

// Stage 3: Unauthenticated-then-admin anomalies — spikes in 401s followed by successful admin actions in IIS logs (via W3CIISLog or CommonSecurityLog ingestion)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has "IIS" or ApplicationProtocol == "http"
| where DestinationHostName has_any ("sharepoint","sp") or DeviceAddress in (dynamic([])) // scope to your SharePoint IPs
| summarize TotalRequests=count(), AuthFailures=countif(AdditionalExtensions has "401"), SuccessAfterFail=countif(AdditionalExtensions has "200") by SourceIP, bin(TimeGenerated, 1h)
| where AuthFailures > 50 and SuccessAfterFail > 0
| order by AuthFailures desc;

-- Hunt: SharePoint post-exploitation indicators (CVE-2026-55040)
-- Part 1: w3wp.exe with suspicious child processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)cmd|powershell|pwsh|certutil|mshta|rundll32|whoami|net\.exe'
  AND Ppid IN (
      SELECT Pid FROM pslist() WHERE Name =~ '(?i)w3wp'
  )

-- Part 2: Recently modified script-executable files in SharePoint LAYOUTS directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/**/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/**/*.ashx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/**/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/14/TEMPLATE/LAYOUTS/**/*.aspx'
])
WHERE Mtime > now() - 60*24*3600
ORDER BY Mtime DESC

# CVE-2026-55040 verification and hardening sweep - run elevated on each SharePoint server

# 1. Report SharePoint build and installed updates (compare against Microsoft advisory build floor)
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -match 'SharePoint' } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

$spBuild = (Get-Item "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.dll" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion
Write-Output "SharePoint product build: $spBuild  <-- VERIFY against the fixed build listed in the MSRC advisory for CVE-2026-55040"

# 2. Sweep LAYOUTS/CONTROLTEMPLATES for script files modified in the last 60 days (potential web shells)
$hiveRoots = @('15','16') | ForEach-Object { "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\$_\TEMPLATE" }
foreach ($root in $hiveRoots) {
  Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
    Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
}

# 3. Confirm AMSI is loaded and Defender real-time protection is active on the SharePoint servers
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AMRunningMode | Format-List

# 4. Audit recent process lineage: w3wp spawning interpreters (last 7 days, requires process auditing or Defender events)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'w3wp.exe' -and $_.Message -match 'cmd.exe|powershell.exe|certutil.exe|mshta.exe' } |
  Select-Object TimeCreated, Message -First 50 | Format-List

# 5. Restrict outbound egress from SharePoint servers as interim mitigation (allow only required destinations)
# Implement via perimeter firewall policy: deny all outbound from SharePoint hosts except Microsoft update/CRL endpoints and approved SaaS
Write-Output "ACTION: Confirm perimeter egress rules restrict SharePoint servers to approved destinations only."