Microsoft August 2026 Patch Tuesday: 421 Flaws, Three Zero-Days — Prioritization, Detection, and Remediation Guide

---
title: Office Application Spawning Script Interpreter or LOLBin
id: 8f2c1a47-3b6e-4d91-a5c2-7e9f0b1d3a58
status: experimental
description: Detects Microsoft Office applications spawning script interpreters, shells, or living-off-the-land binaries — a high-fidelity indicator of document-based exploitation such as the unauthenticated Office RCE flaws patched in the August 2026 Patch Tuesday.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/patch-tuesday-update-now-to-fix-421-flaws-including-three-zero-days
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\MSPUB.EXE'
      - '\VISIO.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msbuild.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate add-ins or document-embedded workflow automation; investigate parent document origin
level: high
---
title: Office Application Creating Executable Content in User-Writable Directories
id: 2d7b9e14-6c3f-48a2-b915-4f8e1c6d0a37
status: experimental
description: Detects Office processes writing executable or script payloads to user-writable or temporary directories, consistent with payload staging following exploitation of an Office remote code execution vulnerability.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/patch-tuesday-update-now-to-fix-421-flaws-including-three-zero-days
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.initial_access
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.vbe'
      - '.ps1'
      - '.bat'
      - '.hta'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Office add-in installers and template updates; correlate with recently opened documents and email delivery logs
level: high
---
title: Office Process Initiating Outbound Network Connection to Rare Destination
id: 5a1e8c36-9d4b-47f3-c2a6-8b0e3d5f1c94
status: experimental
description: Detects Office applications establishing outbound network connections, which may indicate payload download or C2 following exploitation. Baseline before deployment; tune against known add-in and cloud-storage telemetry.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/patch-tuesday-update-now-to-fix-421-flaws-including-three-zero-days
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
  filter_microsoft:
    DestinationHostname|contains:
      - '.microsoft.com'
      - '.office.com'
      - '.office.net'
      - '.sharepoint.com'
      - '.live.com'
      - '.microsoftonline.com'
  condition: selection and not filter_microsoft
falsepositives:
  - Third-party add-ins, linked cloud content, and CRM integrations; maintain an allowlist per business unit
level: medium

// Hunt for Office applications spawning suspicious child processes (Office RCE exploitation pattern)
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mspub.exe", "visio.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (OfficeApps)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256, FolderPath
| extend RiskScore = case(
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("-enc", "-e ", "downloadstring", "invoke-expression", "iex"), "Critical",
    FileName == "certutil.exe" and ProcessCommandLine has "-decode", "Critical",
    FileName == "mshta.exe", "High",
    "Medium")
| order by RiskScore asc, TimeGenerated desc

// Office processes connecting to non-Microsoft destinations (payload retrieval / C2)
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (OfficeApps)
| where RemoteUrl !has_any ("microsoft.com", "office.com", "office.net", "sharepoint.com", "live.com", "microsoftonline.com")
    and RemoteIPType == "Public"
| summarize Connections = count(), Destinations = make_set(RemoteUrl, 20), Ports = make_set(RemotePort)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1d)
| order by Connections desc

-- Hunt for Office-spawned suspicious child processes and staged payloads
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field='CommandLine') AS CmdLine
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd|mshta|wscript|cscript|rundll32|certutil)'
   OR Exe =~ '(?i)(Temp|AppData|Public|ProgramData)\\\\[^\\\\]+\.(exe|dll|ps1|js|vbs|hta)$'

-- Sweep for executable content written to user-writable staging directories in the last 14 days
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/*/AppData/Roaming/*.exe',
                 'C:/Users/*/AppData/Roaming/*.dll',
                 'C:/Users/Public/*.exe',
                 'C:/ProgramData/*.exe'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

# August 2026 Patch Tuesday compliance verification
# Run elevated. Writes results to a CSV for central collection.

$ReportPath = "C:\ProgramData\PatchAudit_Aug2026.csv"
$CutoffDate = Get-Date "2026-08-11"  # August 2026 Patch Tuesday release date

# 1. Enumerate installed hotfixes and identify the most recent
$Hotfixes = Get-HotFix | Sort-Object InstalledOn -Descending
$LatestPatch = $Hotfixes | Select-Object -First 1

# 2. Determine whether any update from the August 2026 cycle is present
$Patched = $Hotfixes | Where-Object { $_.InstalledOn -ge $CutoffDate }
$Status = if ($Patched) { "PATCHED" } else { "EXPOSED - No August 2026 updates found" }

# 3. Check Office Click-to-Run version and pending update state
$OfficeRegPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$OfficeVersion = "Not Installed"
$OfficeChannel = "N/A"
if (Test-Path $OfficeRegPath) {
    $OfficeVersion = (Get-ItemProperty $OfficeRegPath).VersionToReport
    $OfficeChannel = (Get-ItemProperty $OfficeRegPath).CDNBaseUrl
}

# 4. Check for pending reboot that would leave patches incompletely applied
$RebootPending = (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending") -or
                 (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired")

# 5. Write the compliance record
[PSCustomObject]@{
    Hostname          = $env:COMPUTERNAME
    AuditTime         = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Status            = $Status
    LatestHotFix      = $LatestPatch.HotFixID
    LatestInstallDate = $LatestPatch.InstalledOn
    OfficeVersion     = $OfficeVersion
    RebootPending     = $RebootPending
} | Export-Csv -Path $ReportPath -NoTypeInformation -Force

# 6. Cross-reference installed KBs against the Microsoft Security Response Center
#    August 2026 Security Update Guide: https://msrc.microsoft.com/update-guide
#    Verify that the KBs applicable to your OS/Office builds from the August 2026
#    release appear in: Get-HotFix | Select-Object HotFixID, InstalledOn
Write-Output "Audit complete. Cross-reference results against the MSRC August 2026 Update Guide."