How to Defend Against February 2026 Patch Tuesday Exploits

---
title: Suspicious PowerShell Spawning from System Binary
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects PowerShell being spawned by system binaries commonly abused in privilege escalation exploits.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    ParentImage|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\wininit.exe'
      - '\lsass.exe'
  filter:
    CommandLine|contains: 'SignedScript'
condition: selection and not filter
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: Suspicious MSHTA Execution
id: 8b9c0d1e-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects the execution of mshta.exe, often used as a pivot point for exploiting scripting vulnerabilities.
references:
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.defense_evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
falsepositives:
  - Legacy corporate applications requiring HTML application support
level: medium
---
title: Potential Exploit via Windows Script Host
id: 9c0d1e2f-3a4b-5c6d-7e8f-9a0b1c2d3e4f
status: experimental
description: Detects wscript.exe or cscript.exe loading scripts from suspicious paths or with encoding arguments.
references:
  - https://attack.mitre.org/techniques/T1059/005/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '/e:'
      - 'javascript:'
      - 'vbscript:'
falsepositives:
  - Legitimate administrative scripts
level: medium

// Detect PowerShell spawning from unusual parent processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName in ("svchost.exe", "services.exe", "wininit.exe", "lsass.exe")
| where not(ProcessCommandLine contains "SignedScript")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc


// Check for installation of the February 2026 Cumulative Update
// Note: Update the KB Article ID based on specific OS version released
DeviceRegistryEvents
| where Timestamp > ago(1d)
| where RegistryKey contains "KB50"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData
| order by Timestamp desc

-- Hunt for processes spawned by svchost or services that are not typical system services
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name IN ("svchost.exe", "services.exe", "wininit.exe")
  AND Name IN ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe")
  AND NOT CommandLine =~ "SignedScript"


-- Verify installation of February 2026 Patches (Placeholder KB check)
-- Adjust the HotFixID filter with the specific KB numbers for Feb 2026 once released
SELECT HotFixID, Description, InstalledOn
FROM wmi(query="SELECT * FROM Win32_QuickFixEngineering")
WHERE HotFixID =~ "KB50"
  AND InstalledOn > "2026-02-01"

# Check if system has rebooted since Patch Tuesday (Feb 10, 2026)
$PatchDate = Get-Date "2026-02-11"
$LastBoot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime

if ($LastBoot -lt $PatchDate) {
    Write-Host "[WARNING] System has not rebooted since Patch Tuesday. Patches may not be applied." -ForegroundColor Yellow
    Write-Host "Last Boot Time: $LastBoot"
} else {
    Write-Host "[OK] System has rebooted since Patch Tuesday." -ForegroundColor Green
    Write-Host "Last Boot Time: $LastBoot"
}