Microsoft August 2026 Patch Tuesday: 398 CVEs, Three Zero-Days, One Exploited — Defender's Triage and Remediation Guide (CVE-2026-68820)

---
title: SYSTEM Service Process Spawning Command Interpreter
description: Detects critical Windows services (including components patched in August 2026 such as camsvc and Desktop Window Manager) spawning command interpreters or scripting engines — a common post-exploitation pattern following service-level privilege escalation via a zero-day.
references:
  - https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/12
status: experimental
id: 8f2b6c41-3a9e-4d77-b512-6e9c0f4a2d81
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\camsvc.exe'
      - '\dwm.exe'
      - '\svchost.exe'
    ParentCommandLine|contains:
      - 'camsvc'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate service management tools may spawn shells interactively, but services spawning interpreters non-interactively is highly anomalous
level: high
---
title: Suspicious AD CS Certificate Enrollment Activity Following Exploitation
description: Detects certificate template or enrollment abuse indicators associated with AD CS exploitation (ESC-style abuse), relevant given AD CS patches in the August 2026 release. Looks for certutil or certreq execution by non-administrative accounts requesting certificates.
references:
  - https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
  - https://attack.mitre.org/techniques/T1649/
author: Security Arsenal
date: 2026/08/12
status: experimental
id: 3c7a9d12-8b4f-4e61-a905-2f8d1b6e7c93
tags:
  - attack.credential_access
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\certreq.exe'
      - '\certutil.exe'
  selection_args:
    CommandLine|contains:
      - '-enroll'
      - '-submit'
      - '-retrieve'
      - 'CertificateTemplate'
  filter_admins:
    User|contains:
      - 'S-1-5-18'
      - 'S-1-5-19'
      - 'S-1-5-20'
  condition: selection_img and selection_args and not filter_admins
falsepositives:
  - Automated enrollment tooling (MDM, SCEP/NDES integrations) — baseline and exclude known service accounts
level: medium
---
title: Azure Monitor Agent or Cloud Agent Spawning Unexpected Child Process
description: Detects Azure Monitor Agent (AMA) and related Azure hybrid agent processes spawning shells or downloaders, a post-exploitation pattern consistent with cloud agent vulnerabilities patched in August 2026.
references:
  - https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/12
status: experimental
id: 61d4e8a0-2c5b-4f39-87a1-9e0d4c6b3f27
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\MonAgentCore.exe'
      - '\MonAgentHost.exe'
      - '\MonAgentLauncher.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extension deployments via AMA can legitimately invoke scripts — validate against Azure Arc/AMA extension deployment logs before escalating
level: high

// Hunt: SYSTEM services / Azure agents spawning command interpreters (post-exploitation pattern)
// Scope: hosts pending or recently applied August 2026 cumulative updates
let Lookback = 60d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","bitsadmin.exe","certutil.exe"]);
let WatchedParents = dynamic(["camsvc.exe","dwm.exe","MonAgentCore.exe","MonAgentHost.exe","MonAgentLauncher.exe"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessFileName in~ (WatchedParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256, InitiatingProcessId, ProcessId),
(SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID == 4688
| extend Parent = tostring(split(ParentProcessName, "\\")[-1]), Child = tostring(split(NewProcessName, "\\")[-1])
| where Parent in~ (WatchedParents) and Child in~ (SuspiciousChildren)
| project TimeGenerated, Computer, Parent, ParentProcessName, Child, NewProcessName,
          CommandLine, SubjectAccount = TargetUserName, SubjectLogonId)
)
| sort by TimeGenerated desc

// Hunt: Certificate enrollment requests from non-standard accounts/hosts (AD CS abuse)
// Requires AD CS audit policy (Audit Certification Services) enabled on the CA
let Lookback = 60d;
SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID in (4886, 4887) // Certificate Services received a request / issued a certificate
| where TargetUserName !endswith "$" // exclude machine accounts
| summarize RequestCount = count(),
            Templates = make_set(AdditionalInformation, 10),
            SourceHosts = make_set(IpAddress, 10)
        by TargetUserName, Computer
| where RequestCount > 5
| sort by RequestCount desc

-- Security Arsenal: August 2026 Patch Tuesday post-exploitation triage
-- Find processes spawned by services/agents patched in the August 2026 release
LET watched_parents = ('camsvc.exe', 'dwm.exe', 'MonAgentCore.exe', 'MonAgentHost.exe', 'MonAgentLauncher.exe', 'svchost.exe')
LET suspicious_children = ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'mshta.exe', 'rundll32.exe', 'bitsadmin.exe', 'certutil.exe', 'wscript.exe', 'cscript.exe')

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()

SELECT Pid, Name AS ChildProcess, CommandLine AS ChildCmdLine, Username,
       parent.Name AS ParentProcess, parent.CommandLine AS ParentCmdLine, CreateTime
FROM procs
LET parent = SELECT Name, CommandLine FROM procs WHERE Pid = Ppid
WHERE Name =~ regex(string=suspicious_children, sep='|')
  AND parent.Name =~ regex(string=watched_parents, sep='|')

# Security Arsenal - August 2026 Patch Tuesday verification
# Run as SYSTEM / elevated. Verifies update presence and reboot state.

$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{}

# 1. List hotfixes installed since August 1, 2026
$cutoff = Get-Date '2026-08-01'
$recent = Get-HotFix | Where-Object { $_.InstalledOn -ge $cutoff } |
          Sort-Object InstalledOn -Descending
$report['August2026_Hotfixes'] = ($recent | ForEach-Object { "$($_.HotFixID) ($($_.InstalledOn.ToString('yyyy-MM-dd')))" }) -join '; '

# 2. Cross-check via WMI for cumulative updates (captures some updates Get-HotFix misses)
$wmi = Get-CimInstance Win32_QuickFixEngineering | Where-Object { $_.InstalledOn -ge $cutoff }
$report['WMI_UpdateCount_SinceAug2026'] = ($wmi | Measure-Object).Count

# 3. Pending reboot checks (updates staged but not active = still vulnerable)
$pendingReboot = $false
$pendingReboot = $pendingReboot -or (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending')
$pendingReboot = $pendingReboot -or (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired')
$report['PendingReboot'] = $pendingReboot

# 4. Inventory high-risk components from this release
$report['ADCS_Role_Installed'] = [bool](Get-WindowsFeature AD-Certificate | Where-Object Installed)
$report['DotNet_Framework_Release'] = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full').Release
$report['AzureMonitorAgent_Present'] = [bool](Get-Service -Name 'AzureMonitorAgent' -ErrorAction SilentlyContinue)

# 5. Confirm the OS build is at or above the August 2026 baseline for your version
$os = Get-CimInstance Win32_OperatingSystem
$report['OS_Build'] = $os.BuildNumber
$report['OS_Version'] = $os.Version

# 6. Output for central collection
$report.GetEnumerator() | ForEach-Object { "{0} = {1}" -f $_.Key, $_.Value }

# Exit non-zero if reboot pending so RMM/SCCM flags the host as non-compliant
if ($pendingReboot) { exit 3010 } else { exit 0 }