Microsoft September 2026 Patch Tuesday: 966 Flaws and 2 Zero-Days — Defensive Triage and Remediation Playbook

---
title: Office Application Spawning Script Interpreter or Shell
id: 3f8c1a52-7b9d-4e21-a6c4-9d5e2f7a8b01
status: experimental
description: Detects Microsoft Office processes spawning script interpreters or command shells, a hallmark of malicious document exploitation chains frequently used to deliver zero-day payloads.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
      - '\onenote.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins invoking scripts; tune per environment baseline
level: high
---
title: Script Interpreter Executing From User-Writable Temp or AppData Path
id: 8a2e4d17-6c3b-49f0-b5a1-2e7d9c4f6a12
status: experimental
description: Detects script interpreters and LOLBins executing payloads from Temp, AppData, or ProgramData directories, consistent with post-exploitation staging following client-side zero-day exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1218/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_interpreter:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_known_good:
    CommandLine|contains:
      - 'AppData\Local\Microsoft\Teams'
      - 'AppData\Local\Microsoft\OneDrive'
  condition: selection_path and selection_interpreter and not filter_known_good
falsepositives:
  - Software updaters and legitimate user-space installers; baseline and exclude known updater paths
level: medium
---
title: LSASS Memory Access by Non-System Process
id: 5c7f2b94-1d8a-4e35-9b62-4a1c8e3d7f55
status: experimental
description: Detects non-system processes opening a handle to LSASS, a strong indicator of credential dumping during the post-exploitation phase that follows zero-day initial access.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1fffff'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\lsm.exe'
      - '\wininit.exe'
      - '\svchost.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - EDR agents, backup agents, and identity management tooling; whitelist your deployed security stack
level: high

// Hunt: Office or browser-delivered exploitation chains spawning suspicious child processes
// Scope: last 30 days to cover the pre-patch zero-day exploitation window
let Lookback = 30d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"]);
let OfficeOrBrowserParents = dynamic(["winword.exe","excel.exe","powerpnt.exe","outlook.exe","onenote.exe","msedge.exe","chrome.exe","iexplore.exe"]);
DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessFileName in~ (OfficeOrBrowserParents)
| extend CommandLineLower = tolower(ProcessCommandLine)
| extend RiskFlags = strcat(
    iff(CommandLineLower has_any ("-enc", "-e ", "frombase64", "encodedcommand"), "ENCODED_CMD; ", ""),
    iff(CommandLineLower has_any ("http://", "https://", "invoke-webrequest", "iwr", "curl", "downloadstring"), "NETWORK_FETCH; ", ""),
    iff(CommandLineLower has_any ("\\appdata\\", "\\temp\\", "\\users\\public\\", "\\programdata\\"), "USER_WRITABLE_PATH; ", "")
  )
| summarize Executions = count(),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp),
            DistinctHosts = dcount(DeviceName),
            SampleCommands = make_set(strcat(FileName, " | ", ProcessCommandLine), 5)
        by InitiatingProcessFileName, FileName, RiskFlags
| order by FirstSeen asc;

-- Hunt: Recently staged payloads in user-writable paths with active network connections
-- Covers pre-patch zero-day exploitation window
LET staged_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.exe',
  'C:/Users/*/AppData/Local/Temp/*.dll',
  'C:/Users/*/AppData/Roaming/**/*.exe',
  'C:/Users/Public/**/*.exe',
  'C:/ProgramData/**/*.exe'
])
WHERE Mtime > now() - (30 * 24 * 3600)
  AND NOT FullPath =~ 'Microsoft/(Teams|OneDrive|EdgeUpdate)'

LET suspicious_conns = SELECT Pid, Name, Path, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND (RemotePort in (443, 8443, 8080, 53) OR RemoteAddress =~ '^\\d+\\.')
  AND Path =~ '(AppData|Temp|Public|ProgramData)'

SELECT * FROM staged_files
UNION ALL
SELECT * FROM suspicious_conns

# Security Arsenal — September 2026 Patch Tuesday Verification & Hardening Script
# Run as Administrator. Review and test before production deployment.

# --- 1. Report current OS build and last installed hotfixes ---
Write-Host "=== OS Build ===" -ForegroundColor Cyan
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, OsLastBootUpTime | Format-List
Write-Host "=== 10 Most Recently Installed Hotfixes ===" -ForegroundColor Cyan
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn | Format-Table -AutoSize

# --- 2. Check for pending security updates via Windows Update ---
Write-Host "=== Pending Updates Check ===" -ForegroundColor Cyan
if (Get-Module -ListAvailable -Name PSWindowsUpdate) {
    Import-Module PSWindowsUpdate
    $pending = Get-WindowsUpdate -MicrosoftUpdate -CategoryID "0FA1201D-4330-4FA8-8AE9-B877473B6441" -ErrorAction SilentlyContinue
    if ($pending) {
        Write-Host "SECURITY UPDATES PENDING:" -ForegroundColor Red
        $pending | Select-Object KB, Title, Size | Format-Table -AutoSize
    } else {
        Write-Host "No pending security updates detected." -ForegroundColor Green
    }
} else {
    Write-Host "PSWindowsUpdate module not found. Install with: Install-Module PSWindowsUpdate -Scope CurrentUser" -ForegroundColor Yellow
    Write-Host "Falling back to COM-based scan..."
    $session = New-Object -ComObject Microsoft.Update.Session
    $searcher = $session.CreateUpdateSearcher()
    $result = $searcher.Search("IsInstalled=0 and Type='Software'")
    Write-Host "Pending updates found: $($result.Updates.Count)" -ForegroundColor $(if ($result.Updates.Count -gt 0) { "Red" } else { "Green" })
    $result.Updates | ForEach-Object { Write-Host " - $($_.Title)" }
}

# --- 3. Verify Office macro hardening (mitigates doc-delivered exploit chains) ---
Write-Host "=== Office Macro Policy Check ===" -ForegroundColor Cyan
$officeVersions = @("16.0")
foreach ($ver in $officeVersions) {
    $macroKey = "HKLM:\SOFTWARE\Policies\Microsoft\Office\$ver\Word\Security"
    if (Test-Path $macroKey) {
        $vbaWarnings = (Get-ItemProperty -Path $macroKey -Name VBAWarnings -ErrorAction SilentlyContinue).VBAWarnings
        Write-Host "Word VBAWarnings policy: $vbaWarnings (4 = disable all macros)"
    } else {
        Write-Host "No Word macro policy set at $macroKey — consider enforcing via GPO" -ForegroundColor Yellow
    }
}

# --- 4. Block macros from the internet (Mark-of-the-Web policy) ---
$motwKey = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Trust Center"
if (-not (Test-Path $motwKey)) { New-Item -Path $motwKey -Force | Out-Null }
Set-ItemProperty -Path $motwKey -Name "BlockMacrosFromInternet" -Value 1 -Type DWord
Write-Host "Set BlockMacrosFromInternet=1 (macros from internet-sourced files blocked)" -ForegroundColor Green

# --- 5. Enable Windows Defender Attack Surface Reduction prerequisites ---
Write-Host "=== ASR Rule Status (Office child process blocking) ===" -ForegroundColor Cyan
$asrRule = "D4F940AB-401B-4EFC-AADC-AD5F3C50688A"  # Block Office apps from creating child processes
$current = Get-MpPreference
if ($current.AttackSurfaceReductionRules_Ids -contains $asrRule) {
    $idx = [array]::IndexOf($current.AttackSurfaceReductionRules_Ids, $asrRule)
    Write-Host "ASR rule present, mode: $($current.AttackSurfaceReductionRules_Actions[$idx]) (1=Block, 2=Audit)"
} else {
    Write-Host "ASR Office child-process rule NOT configured. Enable in Audit mode first:" -ForegroundColor Yellow
    Write-Host "  Add-MpPreference -AttackSurfaceReductionRules_Ids $asrRule -AttackSurfaceReductionRules_Actions AuditMode"
}

Write-Host "=== Script complete. Prioritize pending security updates per your triage plan. ===" -ForegroundColor Cyan