CVE-2026-85885: Critical Command Injection in Microsoft 365 Copilot (CVSS 9.9) — Detection and Remediation Guide

---
title: Office Application Spawning Shell or Script Interpreter
description: Detects Microsoft Office or Copilot host processes spawning command shells or script interpreters, consistent with post-exploitation command execution following CVE-2026-85885-style injection or malicious content processed through M365 Copilot surfaces.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85885
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 3f8a2c41-7b9e-4d15-a2c6-8e1f5b9d3a72
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msteams.exe'
      - '\msteams.exe'
      - '\copilot.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate add-in behavior; tune per environment baseline
level: high
---
title: M365 Admin Role Assignment Outside Change Window
description: Detects directory role assignments in Entra ID audit telemetry, a common privilege-escalation artifact following exploitation of CVE-2026-85885 where an attacker elevates from an authorized low-privilege Copilot user.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85885
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/04/06
id: 9c4d7e12-5a3b-4f86-b1d9-2e7c6a8f4b15
status: experimental
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Add member to role'
      - 'Add eligible member to role'
      - 'Add service principal to role'
  filter_known_admins:
    InitiatedBy|contains:
      - '@yourdomain.com'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate IAM administration; scope the filter to your actual admin UPN suffixes and PIM workflows
level: high
---
title: Suspicious Application Consent Grant Following Copilot Session
description: Detects OAuth consent grants to applications, a persistence and data-access technique frequently chained after privilege escalation in M365 tenants, including scenarios involving CVE-2026-85885.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85885
  - https://attack.mitre.org/techniques/T1550/
author: Security Arsenal
date: 2026/04/06
id: 61b3f8d4-2c7a-4e59-9d83-4f1a7c5e2b96
status: experimental
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add app role assignment to service principal'
  selection_scope:
    TargetResources|contains:
      - 'Mail.Read'
      - 'Files.Read.All'
      - 'Sites.FullControl.All'
      - 'Directory.Read.All'
  condition: selection and selection_scope
falsepositives:
  - Approved enterprise app onboarding; maintain an allowlist of sanctioned app registrations
level: medium

// Hunt: Copilot activity followed by privilege escalation artifacts (CVE-2026-85885)
let Window = 4h;
let CopilotUsers =
    OfficeActivity
    | where TimeGenerated > ago(24h)
    | where OfficeWorkload =~ "Copilot" or Operation has_any ("CopilotInteraction", "Copilot")
    | summarize CopilotActions = count(), FirstSeen = min(TimeGenerated) by UserId, ClientIP;
let EscalationEvents =
    AuditLogs
    | where TimeGenerated > ago(24h)
    | where OperationName has_any ("Add member to role", "Add eligible member to role", "Consent to application", "Add app role assignment to service principal", "Add service principal credentials")
    | extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName)
    | extend TargetOps = OperationName;
CopilotUsers
| join kind=inner (EscalationEvents) on $left.UserId == $right.ActorUPN
| where TimeGenerated between (FirstSeen .. (FirstSeen + Window))
| project UserId, ClientIP, CopilotActions, FirstSeen, EscalationTime = TimeGenerated, TargetOps, ResultDescription
| sort by EscalationTime desc;
// Supplemental: burst of Graph/SharePoint access from a single user post-Copilot session
OfficeActivity
| where TimeGenerated > ago(24h)
| where OfficeWorkload in ("SharePoint", "OneDrive", "Exchange")
| summarize FileOps = count(), DistinctSites = dcount(SiteUrl) by UserId, ClientIP, bin(TimeGenerated, 1h)
| where FileOps > 200 or DistinctSites > 25
| sort by FileOps desc;

-- Hunt: M365 app processes spawning shells or script interpreters
SELECT Pid,
       Ppid,
       Name AS ProcessName,
       Exe AS ProcessPath,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ '(?i)(winword|excel|powerpnt|outlook|msteams|copilot)\.exe$'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)\.exe$'

# CVE-2026-85885 — M365 Copilot tenant hardening and exposure verification
# Requires: Microsoft.Graph PowerShell SDK (scopes: Directory.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All)

# 1. Connect and confirm context
Connect-MgGraph -Scopes "Directory.Read.All","RoleManagement.Read.Directory","AuditLog.Read.All" -NoWelcome
$ctx = Get-MgContext
Write-Host "[+] Connected to tenant: $($ctx.TenantId)" -ForegroundColor Green

# 2. Enumerate Copilot license assignments — attack surface = licensed, authorized users
Write-Host "`n[*] Enumerating M365 Copilot license assignments..." -ForegroundColor Cyan
$copilotSku = Get-MgSubscribedSku -All | Where-Object { $_.SkuPartNumber -match "Copilot" }
foreach ($sku in $copilotSku) {
    Write-Host "    SKU: $($sku.SkuPartNumber) — Consumed: $($sku.ConsumedUnits)/$($sku.PrepaidUnits.Enabled)"
}

# 3. Review recent directory role assignments (last 7 days) — escalation artifact
Write-Host "`n[*] Reviewing directory role membership changes (last 7 days)..." -ForegroundColor Cyan
$since = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
$roleEvents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -match "Add member to role|Add eligible member to role" }
if ($roleEvents) {
    $roleEvents | ForEach-Object {
        Write-Host "    [!] $($_.ActivityDateTime) | $($_.ActivityDisplayName) | Initiator: $($_.InitiatedBy.user.userPrincipalName)" -ForegroundColor Yellow
    }
    $roleEvents | Export-Csv -Path ".\RoleAssignment_Review_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
    Write-Host "    Exported to RoleAssignment_Review_$(Get-Date -Format yyyyMMdd).csv"
} else {
    Write-Host "    [+] No role assignment events in window."
}

# 4. Flag service principals with high-privilege Graph scopes granted recently
Write-Host "`n[*] Checking recent OAuth grants for high-privilege scopes..." -ForegroundColor Cyan
$grants = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -match "Consent to application" }
$grants | ForEach-Object {
    $scopes = ($_.TargetResources[0].modifiedProperties | Where-Object { $_.displayName -match "Consent" }).newValue
    if ($scopes -match "Mail.Read|Files.Read.All|Sites.FullControl|Directory.Read") {
        Write-Host "    [!] HIGH-PRIV CONSENT: $($_.ActivityDateTime) | $($_.InitiatedBy.user.userPrincipalName) | $scopes" -ForegroundColor Red
    }
}

# 5. Verify Unified Audit Log is enabled (required for Copilot interaction hunting)
Write-Host "`n[*] Verify Unified Audit Log status at: https://purview.microsoft.com/audit" -ForegroundColor Cyan
Write-Host "    Copilot interaction records (CopilotInteraction) must be retained for detection queries."

# 6. Restrict Copilot web-grounded chat and plugin scope pending Microsoft mitigation confirmation
Write-Host "`n[*] Recommended: review Copilot plugin/agent permissions at https://admin.microsoft.com > Copilot > Settings" -ForegroundColor Cyan
Write-Host "    - Disable non-essential third-party plugins and connectors"
Write-Host "    - Restrict Copilot Studio agent publishing to approved makers"
Write-Host "    - Apply Conditional Access requiring compliant devices for Copilot access"