Microsoft's Record 974-Vulnerability Patch Tuesday (September 2026): Two Actively Exploited Windows Zero-Days — Prioritization, Detection, and Remediation Guide

---
title: Office Application Spawning Script Interpreter or Shell
id: 3f8c2a91-6b4d-4e1a-9c57-2d8f4b6a1e90
status: experimental
description: Detects Microsoft Office processes spawning command shells, script interpreters, or LOLBins. Consistent with post-exploitation behavior following document-borne exploitation of Office RCE flaws patched in the September 2026 record Patch Tuesday (111 Office flaws addressed).
references:
  - https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.exploitation_for_client_execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\onenote.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins or macros in controlled development environments
level: high
---
title: SQL Server Process Spawning Command Shell or Script Interpreter
id: 7d1e5b42-9a3c-4f68-b812-4c6d9e2a7f35
status: experimental
description: Detects sqlservr.exe or SQL Server Agent spawning command shells, PowerShell, or script interpreters. Behavioral indicator of post-exploitation following SQL Server vulnerability abuse; 62 SQL flaws were patched in the September 2026 Microsoft release.
references:
  - https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.exploit_public_facing_application
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\sqlservr.exe'
      - '\sqlagent.exe'
      - '\sqlps.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - xp_cmdshell legitimately enabled and used by database administrators (should be disabled; treat any hit as review-worthy)
  - SQL Agent jobs executing scripts (validate against documented job schedules)
level: high
---
title: Suspicious SYSTEM-Level Process Tree Following Service or Kernel Exploitation
id: 9c4a7d16-2e5b-4a89-8f31-6b3e1c9d4a72
status: experimental
description: Detects interactive shells, download cradles, or discovery tooling running as NT AUTHORITY\SYSTEM spawned by services or unusual parents. Consistent with post-exploitation after Windows elevation-of-privilege zero-day abuse, the class of the two actively exploited flaws patched September 2026.
references:
  - https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains: 'SYSTEM'
  selection_cmd:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'net localgroup'
      - 'quser'
      - 'systeminfo'
      - 'Invoke-'
      - 'IEX'
      - 'DownloadString'
      - 'certutil -urlcache'
      - 'bitsadmin /transfer'
  filter_parents:
    ParentImage|endswith:
      - '\wmiprvse.exe'
      - '\services.exe'
      - '\svchost.exe'
      - '\spoolsv.exe'
      - '\MsMpEng.exe'
      - '\sqlservr.exe'
  condition: selection_user and selection_cmd and not filter_parents
falsepositives:
  - Legitimate system management agents (SCCM, Tanium, RMM tooling) — baseline and allowlist known tooling by full path and signer
  - Backup and monitoring software executing SYSTEM-context scripts
level: medium

let PatchWindowStart = ago(14d);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"]);
let OfficeParents = dynamic(["winword.exe","excel.exe","powerpnt.exe","outlook.exe","onenote.exe","mspub.exe"]);
let SqlParents = dynamic(["sqlservr.exe","sqlagent.exe","sqlps.exe"]);
DeviceProcessEvents
| where TimeGenerated >= PatchWindowStart
| extend ParentName = tolower(tostring(split(InitiatingProcessFileName, "\\")[-1])), ChildName = tolower(FileName)
| where (ParentName in~ (OfficeParents) or ParentName in~ (SqlParents))
    and ChildName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated >= PatchWindowStart
    | where AccountName =~ "SYSTEM"
    | where ProcessCommandLine has_any ("whoami","net user","net localgroup","systeminfo","DownloadString","IEX","certutil -urlcache")
    | project SystemActivityTime = TimeGenerated, DeviceName, SystemCmd = ProcessCommandLine
) on DeviceName
| summarize OfficeOrSqlHits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    SampleCommands = make_set(ProcessCommandLine, 5), SystemDiscoveryCmds = make_set(SystemCmd, 5)
    by DeviceName, AccountName
| order by FirstSeen asc

DeviceInfo
| where TimeGenerated >= ago(1d)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated >= ago(7d)
    | summarize LastActivity = max(TimeGenerated) by DeviceId
) on DeviceId
| summarize arg_max(TimeGenerated, *) by DeviceId
| project DeviceName, OSPlatform, OSVersion, OSBuild, LastActivity
| order by OSBuild asc

-- Hunt: Post-exploitation indicators relevant to September 2026 Patch Tuesday zero-day abuse
-- Looks for Office/SQL-spawned shells and SYSTEM-context execution of discovery/cradle tooling
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       dict(Ppid=Ppid) as _ParentLookup
FROM pslist()
WHERE (
    -- Child of Office or SQL processes
    Ppid IN (
        SELECT Pid FROM pslist()
        WHERE Name =~ '(?i)(winword|excel|powerpnt|outlook|onenote|mspub|sqlservr|sqlagent)'
    )
    AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)'
)
OR (
    -- SYSTEM-context discovery or download cradle execution
    Username =~ '(?i)SYSTEM'
    AND CommandLine =~ '(?i)(whoami|net user|net localgroup|systeminfo|DownloadString|IEX|certutil -urlcache|bitsadmin /transfer)'
)

#requires -RunAsAdministrator
# Security Arsenal — September 2026 Patch Tuesday verification & enforcement helper
# Validates OS build recency, lists installed Sept-2026 hotfixes, triggers update scan, flags legacy Office

$ErrorActionPreference = 'Continue'
$report = [ordered]@{}

# --- 1. OS build and last boot (long uptime = updates likely not applied) ---
$os = Get-CimInstance Win32_OperatingSystem
$report['OSBuild'] = $os.BuildNumber
$report['OSVersion'] = $os.Version
$report['LastBoot'] = $os.LastBootUpTime
$report['UptimeDays'] = [math]::Round(((Get-Date) - $os.LastBootUpTime).TotalDays, 1)

# --- 2. Installed hotfixes from September 2026 forward ---
$septPatches = Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-09-08') } |
    Sort-Object InstalledOn -Descending
$report['Sept2026HotfixCount'] = ($septPatches | Measure-Object).Count
$report['Sept2026Hotfixes'] = ($septPatches | Select-Object -ExpandProperty HotFixID) -join ', '

# --- 3. Pending reboot check (patch applied but not effective until reboot) ---
$rebootPending = $false
$paths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
)
foreach ($p in $paths) { if (Test-Path $p) { $rebootPending = $true } }
$report['RebootPending'] = $rebootPending

# --- 4. Detect legacy Office 2016 installs (111 Office/Office 2016 flaws patched this cycle) ---
$officeKeys = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Microsoft Office' } |
    Select-Object DisplayName, DisplayVersion
$report['OfficeInstalls'] = ($officeKeys | ForEach-Object { "$($_.DisplayName) $($_.DisplayVersion)" }) -join '; '
$report['Office2016Present'] = [bool]($officeKeys | Where-Object { $_.DisplayVersion -like '16.*' -and $_.DisplayName -notmatch '365' })

# --- 5. Force a Windows Update scan against configured source (WSUS/WUfB/Intune) ---
try {
    $updateSession = New-Object -ComObject Microsoft.Update.Session
    $searcher = $updateSession.CreateUpdateSearcher()
    $result = $searcher.Search("IsInstalled=0 and Type='Software'")
    $report['UpdatesPending'] = $result.Updates.Count
    $report['PendingCritical'] = @($result.Updates | Where-Object { $_.MsrcSeverity -eq 'Critical' }).Count
} catch {
    $report['UpdateScanError'] = $_.Exception.Message
}

# --- 6. Verdict ---
if ($report['Sept2026HotfixCount'] -gt 0 -and -not $rebootPending) {
    $report['Status'] = 'PATCHED - September 2026 updates installed, no reboot pending'
} elseif ($rebootPending) {
    $report['Status'] = 'ACTION REQUIRED - Updates installed, REBOOT PENDING (system still vulnerable until restart)'
} else {
    $report['Status'] = 'ACTION REQUIRED - No September 2026 hotfixes detected'
}

$report.GetEnumerator() | ForEach-Object { "{0,-22}: {1}" -f $_.Key, $_.Value }

# Exit code for RMM/SCCM compliance rules: 0 = patched, 1 = action required
if ($report['Status'] -like 'PATCHED*') { exit 0 } else { exit 1 }