Microsoft September 2026 Patch Tuesday: 974 CVEs, 2 Zero-Days, 20 Wormable Bugs — Prioritization and Remediation Playbook

---
title: Exchange Server Process Spawning Suspicious Child Process
id: 4b8c2a91-7d3e-4f5a-b6c9-2e1a8d4f7b3c
status: experimental
description: Detects Exchange worker or service processes spawning command shells, scripting engines, or other unusual child processes — a hallmark of post-exploitation following Exchange RCE such as the September 2026 Visio-email vector.
references:
  - https://securityaffairs.com/198705/security/microsofts-biggest-patch-tuesday-974-cves-2-zero-days-and-20-wormable-bugs.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\w3wp.exe'
      - '\Microsoft.Exchange'
      - '\MSExchange'
      - '\EdgeTransport.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\curl.exe'
      - '\wget.exe'
  filter_owa_health:
    CommandLine|contains:
      - 'ExchangeHealthManager'
      - 'MonitoringContext'
  condition: selection_parent and selection_child and not filter_owa_health
falsepositives:
  - Exchange health monitoring and managed availability probes (filter and baseline per environment)
  - Legitimate Exchange administrative tooling executed interactively
level: high
---
title: Visio Application Spawning Shell or Script Interpreter
id: 9f2e5b74-1c6a-4d8e-a3b7-5c9d2f6a8e1b
status: experimental
description: Detects Microsoft Visio (VISIO.EXE) spawning command shells or script interpreters, consistent with exploitation of malicious Visio documents used as the delivery vehicle in the September 2026 Exchange critical RCE chain or client-side phishing.
references:
  - https://securityaffairs.com/198705/security/microsofts-biggest-patch-tuesday-974-cves-2-zero-days-and-20-wormable-bugs.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\VISIO.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
      - '\schtasks.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Visio add-ins with shell integration — investigate any hit
level: high
---
title: Web Server Process Writing Executable or Script to Exchange Web Directories
id: 2d7a4f18-8b5c-4e9d-b1a6-3f8c5e2d9a4b
status: experimental
description: Detects w3wp.exe or Exchange processes writing executables, scripts, or ASPX files into Exchange FrontEnd/ClientAccess directories — the classic web shell drop pattern following Exchange RCE exploitation.
references:
  - https://securityaffairs.com/198705/security/microsofts-biggest-patch-tuesday-974-cves-2-zero-days-and-20-wormable-bugs.html
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Microsoft\Exchange Server\'
      - '\FrontEnd\HttpProxy\'
      - '\ClientAccess\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.js'
  filter_cumulative_update:
    TargetFilename|contains:
      - '\Setup\'
      - '\Bin\ServiceUpdate\'
      - 'CumulativeUpdate'
  condition: selection_path and selection_ext and not filter_cumulative_update
falsepositives:
  - Exchange cumulative update installations — suppress during approved change windows only
level: critical

// Hunt 1: Exchange/w3wp spawning suspicious children + Visio-borne delivery
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe","net.exe","whoami.exe","nltest.exe"]);
let ExchangeRCE =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
   or InitiatingProcessFileName startswith "Microsoft.Exchange"
   or InitiatingProcessFileName =~ "EdgeTransport.exe"
   or InitiatingProcessFileName =~ "MSExchangeFrontendTransport.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256;
let VisioDelivery =
EmailAttachmentInfo
| where TimeGenerated > ago(14d)
| where FileName has_any (".vsd",".vsdx",".vssx",".vstx",".vsdm",".vssm",".vstm")
| join kind=leftouter (
    EmailEvents
    | where TimeGenerated > ago(14d)
    | project NetworkMessageId, SenderFromAddress, Subject, InternetMessageId, DeliveryAction
  ) on NetworkMessageId
| project TimeGenerated, SenderFromAddress, Subject, FileName, SHA256, RecipientEmailAddress, DeliveryAction;
let VisioChildProc =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "VISIO.EXE"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName;
ExchangeRCE
| union VisioChildProc
| sort by TimeGenerated desc;
// Hunt 2 (run separately): Visio-borne email inventory for exposure scoping
// VisioDelivery | summarize count() by SenderFromAddress, FileName

-- Hunt for recently written script/executable files in Exchange web directories
-- and suspicious Exchange-spawned processes
LET web_dirs = [
  'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.aspx',
  'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.ashx',
  'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.asp',
  'C:/Program Files/Microsoft/Exchange Server/V15/ClientAccess/**/*.aspx'
]

LET file_hits = SELECT FullPath, Size, Mtime, Ctime
FROM foreach(row=web_dirs,
  query={ SELECT FullPath, Size, Mtime, Ctime FROM glob(globs=_value) })
WHERE Mtime > (now() - 30 * 24 * 3600)

LET proc_hits = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)w3wp|Microsoft\.Exchange|EdgeTransport'
   AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|net\.exe|whoami')

SELECT * FROM file_hits
UNION ALL
SELECT FullPath=NULL, Size=NULL, Mtime=NULL, Ctime=NULL,
       Pid=Pid, Name=Name, CommandLine=CommandLine, Username=Username, CreateTime=CreateTime
FROM proc_hits

# =============================================================
# September 2026 Patch Tuesday — Fleet Verification & Triage
# Run elevated. Review output before drawing conclusions.
# =============================================================
$Report = [ordered]@{}

# --- 1. OS build + installed hotfixes from Sept 2026 onward ---
$os = Get-CimInstance Win32_OperatingSystem
$Report['OSBuild'] = "$($os.Caption) $($os.Version) (Build $($os.BuildNumber))"
$Report['RecentHotfixes'] = Get-HotFix |
    Where-Object { $_.InstalledOn -ge (Get-Date '2026-09-08') } |
    Select-Object HotFixID, Description, InstalledOn

# --- 2. Exchange Server detection and version ---
$exchSetup = 'HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup'
if (Test-Path $exchSetup) {
    $Report['ExchangeDetected'] = $true
    $Report['ExchangeVersion'] = (Get-ItemProperty $exchSetup -ErrorAction SilentlyContinue |
        Select-Object MsiProductMajor, MsiProductMinor, MsiBuildMajor, MsiBuildMinor)
    Write-Warning 'Exchange Server detected: cross-reference build numbers against the Microsoft Exchange Server build number table and apply the September 2026 Security Update IMMEDIATELY.'
} else {
    $Report['ExchangeDetected'] = $false
}

# --- 3. Triage sweep: recent script/exe writes in Exchange web dirs ---
$webRoots = @(
  "$env:SystemDrive\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy",
  "$env:SystemDrive\Program Files\Microsoft\Exchange Server\V15\ClientAccess"
)
$suspiciousExt = '.aspx','.ashx','.asp','.asmx','.exe','.dll','.ps1','.bat','.js'
$Report['RecentWebWrites'] = foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $suspiciousExt -contains $_.Extension.ToLower() -and
                           $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, Length
    }
}

# --- 4. Pending reboot check (patch not effective until reboot) ---
$Report['RebootPending'] = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or
                           (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired')

$Report.GetEnumerator() | ForEach-Object { "=== $($_.Key) ==="; $_.Value | Format-List | Out-String }