Microsoft February 2026 Patch Tuesday: Defending Against Six Zero-Day Vulnerabilities

---
title: Potential SharePoint Web Shell Creation via IIS
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the creation of suspicious ASPX files in SharePoint directories, often indicative of web shell upload following RCE exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/15
tags:
  - attack.persistence
  - attack.webshell
  - attack.t1505.003
logsource:
  product: windows
  category: file_create
detection:
  selection:
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\wss\\VirtualDirectories\\'
      - '\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
  condition: selection
falsepositives:
  - Legitimate SharePoint administration or custom development deployments
level: high
---
title: Suspicious Process Spawn by w3wp.exe (SharePoint RCE)
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects w3wp.exe (IIS Worker Process) spawning cmd, powershell, or regsvr32. This is a strong indicator of successful RCE or web shell execution.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\regsvr32.exe'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate administrators usually do not interact with the server this way.
level: critical
---
title: Windows Kernel Exploitation via Suspicious Driver Load
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects the loading of drivers with suspicious signatures or from temporary paths, often used in kernel EoP exploits.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/02/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    Signed: 'false'
    ImageLoaded|contains:
      - '\\Temp\\'
      - '\\AppData\\Local\\Temp\\'
  condition: selection
falsepositives:
  - Legitimate driver testing (rare in production)
level: high

// Hunt for suspicious process chains indicative of SharePoint RCE exploitation
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessId
| extend FullContext = strcat("Parent Command Line: ", InitiatingProcessCommandLine, " | Child Command Line: ", ProcessCommandLine)
| order by Timestamp desc

-- Hunt for recently modified ASPX/ASHX files in SharePoint directories
-- which could indicate web shell persistence from the Feb 2026 RCE
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/*
*/wwwroot/*
*.aspx', root='/', accessor='auto')
WHERE Mtime > now() - 7d
   OR Atime > now() - 7d

-- Hunt for w3wp.exe spawning suspicious shells
SELECT Parent.Name, Parent.Pid, Name, Pid, CommandLine, StartTime
FROM pslist()
LEFT JOIN SELECT Pid as ParentPid, Name as ParentName FROM pslist() ON ParentPid = Parent.Pid
WHERE ParentName =~ "w3wp"
  AND Name =~ "(cmd|powershell|pwsh)"

# Script to verify installation of February 2026 Cumulative Updates
# Run with Administrative Privileges

$ExpectedUpdates = @(
    # Placeholder KBs - Replace with actual February 2026 KB IDs from MSRC
    "KB5035853", # Example Win10/Server 202x
    "KB5035854"  # Example Win11
)

Write-Host "Checking for February 2026 Security Updates..." -ForegroundColor Cyan

$InstalledUpdates = Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2026-02-10") }

$MissingUpdates = @()
foreach ($KB in $ExpectedUpdates) {
    $Found = $InstalledUpdates | Where-Object { $_.HotFixID -eq $KB }
    if (-not $Found) {
        Write-Host "[MISSING] $KB" -ForegroundColor Red
        $MissingUpdates += $KB
    } else {
        Write-Host "[FOUND] $KB" -ForegroundColor Green
    }
}

if ($MissingUpdates.Count -gt 0) {
    Write-Host "CRITICAL: Missing $($MissingUpdates.Count) critical patches. Initiate patching immediately." -ForegroundColor Red
} else {
    Write-Host "All tracked updates appear to be installed." -ForegroundColor Green
}