Defending Against the 6 Zero-Day Vulnerabilities in Microsoft’s February 2026 Patch Tuesday

---
title: Suspicious Service Binary Modification
id: 4a8f9c2d-1e3b-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects modifications to system service binaries which may indicate an attempt to exploit an EoP vulnerability or install a persistence mechanism.
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\System32\drivers\'
      - '\System32\'
    TargetFilename|endswith:
      - '.sys'
      - '.dll'
  filter:
    Image|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\msiexec.exe'
      - '\trustedinstaller.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate software updates or driver installations
level: high
---
title: Potential Zero-Day Exploit via Office Suspicious Child Process
id: b7c8d9e0-f1a2-3456-bcde-f01234567890
status: experimental
description: Detects Microsoft Office applications spawning suspicious child processes often used in exploit chains or RCE payloads.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate macro usage for automation (rare)
level: high

DeviceProcessEvents  
| where Timestamp > ago(7d)  
| where InitiatingProcessFileName in~ ('svchost.exe', 'winlogon.exe', 'lsass.exe')  
| where not(ProcessFileName in~ ('conhost.exe', 'werfault.exe', 'rundll32.exe'))  
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, FolderPath


**Check for Patch Installation Status (Feb 2026 Patches):**

DeviceRegistryEvents  
| where Timestamp > ago(3d)  
| where RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\Packages"  
| where RegistryValueData contains "2026-02"  // Adjust based on specific KB package naming convention
| summarize count(), arg_max(Timestamp, *) by DeviceId, RegistryKey

-- Hunt for system drivers modified in the last 7 days (Potential Kernel Exploitation)
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='C:\Windows\System32\drivers\*.sys')
WHERE Mtime > now() - 7D
  AND NOT Mode.IsRegular
-- Sort by modification time to see the newest changes
ORDER BY Mtime DESC


**Hunt for Suspicious PowerShell Execution Logs:**

-- Hunt for PowerShell script block logs containing encoded payloads
SELECT Timestamp, ComputerName, ScriptBlockText, ScriptBlockID
FROM windows_eventlog(channel='Microsoft-Windows-PowerShell/Operational')
WHERE EventID == 4104
  AND ScriptBlockText =~ 'EncodedCommand'
  AND ScriptBlockText !~ 'AuthorizationManager'
LIMIT 50

<#
.SYNOPSIS
    Checks for the installation of February 2026 Security Updates.
.DESCRIPTION
    This script queries the WMI for hotfixes matching the February 2026 Patch Tuesday release.
    Update the $RequiredHotfixes array with the specific KBs relevant to your environment.
#>

$RequiredHotfixes = @(
    "KB5012345", # Placeholder for Feb 2026 Cumulative Update
    "KB5012346"  # Placeholder for specific Security Only update
)

$InstalledHotfixes = Get-HotFix | Select-Object -ExpandProperty HotFixID

$MissingPatches = @()

foreach ($KB in $RequiredHotfixes) {
    if ($InstalledHotfixes -notcontains $KB) {
        $MissingPatches += $KB
        Write-Warning "Missing Patch: $KB"
    } else {
        Write-Host "[OK] Patch Installed: $KB" -ForegroundColor Green
    }
}

if ($MissingPatches.Count -gt 0) {
    Write-Error "System is vulnerable. Please install missing updates immediately."
    Exit 1
} else {
    Write-Host "All monitored security patches for Feb 2026 are installed." -ForegroundColor Cyan
    Exit 0
}