Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World Attacks

Key facts for TL-2026-5099

Detection coverage for TL-2026-5099

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5099 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5099 Server-Side RCE — Web Server Process Spawning Shell or Recon Tool (T1190, T1059, T1505, T1033)

Detects web server worker processes (w3wp.exe, httpd.exe, nginx.exe, php-cgi.exe, Tomcat) spawning cmd, PowerShell, script hosts, downloaders or operator recon utilities (whoami, net, nltest, systeminfo). Server-side RCE is the largest exploited-CVE class (37%) in the Microsoft analysis and network edge/web-facing systems are the most targeted technologies in VulnCheck 1H 2026 data; regardless of the CVE, successful exploitation or a dropped web shell produces this parent-child pattern. Maps to T1190, T1059, T1505 and T1033.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1505, T1033
• Data sources: sysmon, microsoft_defender_endpoint:DeviceProcessEvents, sigma:windows/process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\tomcat*.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\curl.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe" OR Image="*\\systeminfo.exe" OR Image="*\\ipconfig.exe" OR Image="*\\tasklist.exe" OR Image="*\\hostname.exe" OR Image="*\\quser.exe")
```Web server worker spawning a shell, downloader or recon utility indicates server-side RCE exploitation or web shell execution (T1190, T1059, T1505, T1033)```
| eval child=lower(Image), recon=if(match(child,"(whoami|net1?|nltest|systeminfo|ipconfig|tasklist|hostname|quser)\\.exe$"),1,0), shell=if(match(child,"(cmd|powershell|pwsh|wscript|cscript|mshta)\\.exe$"),1,0)
| stats count sum(recon) as recon_children sum(shell) as shell_children min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_command_lines values(Image) as child_images by host ParentImage ParentCommandLine User
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5099", mitre="T1190,T1059,T1505,T1033", exploit_class="server-side RCE", webshell_suspect=if(shell_children>0 AND recon_children>0,"yes","no")
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "tomcat8.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "systeminfo.exe", "ipconfig.exe", "tasklist.exe", "hostname.exe", "quser.exe")
| extend Technique = case(FileName in~ ("whoami.exe", "net.exe", "net1.exe", "nltest.exe", "systeminfo.exe", "ipconfig.exe", "tasklist.exe", "hostname.exe", "quser.exe"), "T1033 discovery from web worker", "T1059 command execution from web worker")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Technique
| order by Timestamp desc

Sigma

title: Web Server Worker Process Spawning Shell or Recon Utility
id: 7c1b3e52-4a8d-4f21-9b6e-1d2a3c4e5f01
status: experimental
description: Detects a web server worker process (IIS, Apache, Nginx, PHP-CGI, Tomcat) spawning a shell, downloader or reconnaissance utility, the classic child-process signature of server-side RCE exploitation (T1190), web shell execution (T1505.003), command interpreter use (T1059) and operator discovery (T1033) described in the Microsoft takeover-class vulnerability analysis
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - https://www.vulncheck.com/blog/state-of-exploitation-1h-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
    - attack.discovery
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\tomcat8.exe'
            - '\tomcat9.exe'
            - '\tomcat10.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\systeminfo.exe'
            - '\ipconfig.exe'
            - '\tasklist.exe'
            - '\hostname.exe'
            - '\quser.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate web applications that shell out to helper executables
    - Administrative maintenance scripts launched by the web server service
level: high

Known false positives:

• Legitimate web applications that invoke helper executables such as certutil or curl for scheduled tasks
• Administrators using web-hosted management consoles that spawn cmd.exe
• Deployment or health-check scripts run by an application pool identity

Tuning notes: Allow-list known application pool identities and exact CommandLine values of sanctioned helper scripts. Scope to internet-facing web servers first; raise severity when webshell_suspect=yes (shell and recon children from the same parent) or the child runs as a service identity with network egress.

• 🔒 TL-2026-5099 Client-Side RCE — Office, PDF Reader or Browser Spawning Script Interpreter (T1203, T1059, T1218) · unlock with TL Creds
• 🔒 TL-2026-5099 Defense Impairment — Defender, Logging and Firewall Tampering (T1562, T1070, T1059) · unlock with TL Creds
• 🔒 TL-2026-5099 Unsecured Credentials — Credential File, Registry and Vault Hunting (T1552, T1555, T1083) · unlock with TL Creds
• 🔒 TL-2026-5099 Exploit Public-Facing Application — Traversal/Command Injection in Web Requests (T1190, T1059, T1083) · unlock with TL Creds
• 🔒 TL-2026-5099 Unsecured Credentials — Instance Metadata Service Token Theft (T1552, T1528, T1078) · unlock with TL Creds
• 🔒 TL-2026-5099 Endpoint DoS / Failed Exploitation — Crashes of Exposed Services (T1499, T1190, T1210) · unlock with TL Creds
• 🔒 TL-2026-5099 Local Privilege Escalation — SYSTEM Shell from User-Writable Non-SYSTEM Parent (T1068, T1134, T1059) · unlock with TL Creds
• 🔒 TL-2026-5099 Remote Service Exploitation — Network Fan-Out on SMB/RPC/RDP/WinRM (T1210, T1021, T1046) · unlock with TL Creds

Indicators of compromise for TL-2026-5099

As of 2026-11-02, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5099.

How Microsoft Security Research works

On 2026-11-02 Microsoft Security Research (Yair Tsarfaty, Or Begam) published an aggregate analysis of Microsoft's catalog of tracked vulnerabilities covering CVEs published through September 2026. Of roughly 383,000 software vulnerabilities disclosed since 1999, about 2,000 (0.5%) are linked to real-world exploitation; the study counts 2,056 exploited CVEs. 77% of all CVEs affect application code and 23% operating systems, but exploited CVEs skew to operating-system code (41%).

Each CVE was classified by its consequential security outcome rather than its stated class. Server-side RCE accounts for 37% of exploited CVEs (vs. 20% of all published CVEs), local privilege escalation 18% (vs. 11%), client-side RCE 13% (vs. 4%). XSS (4% exploited vs. 15% published) and denial of service (7% vs. 16%) are under-represented among exploited flaws. Takeover vulnerabilities (RCE, authentication bypass, privilege escalation) make up 78% of exploited CVEs. Windows and Linux/Unix are the most affected platforms; 1,239 exploited remote-takeover CVEs were analyzed across platforms (Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, developer packages).

Exploitation velocity: 29% of exploits in 2025 were launched within one day of CVE publication; the mean time from publication to CISA KEV entry was 57 days in 2025 and 20 days in 2026 through September, with a median of 3 days. AI-assisted discovery is cited as an accelerating factor. Reported patching timelines in 2026 are about 2 weeks for Windows workstations, over 1 month for Windows servers, 10+ weeks for Linux servers and macOS applications, and over 1 year for network appliances.

The article names no CVEs, threat actors, malware families or network indicators. Its defensive guidance: prioritize remote-takeover classes first; treat DoS on availability-critical assets and credential/secret disclosure feeding privileged-identity compromise as secondary priorities; focus on exposed systems with privileged identities; use external attack surface management, exposure scoring beyond CVSS and attack path analysis, since patching can take weeks or months and some legacy systems cannot be patched. Cited data sources include VulnCheck's State of Exploitation 2026, CISA KEV data and CVE.org metrics. Corroborating context: VulnCheck's 1H 2026 report identified 495 KEVs in the first half of 2026, 23.43% with evidence of exploitation on or before CVE disclosure, with network edge devices (firewalls, VPNs, proxies) the most targeted technologies. The CISA KEV catalog listed 1,766 entries as of 2026-11-02 and is governed by BOD 26-04.

This is a research/context item, not an active campaign; indicators in this record are entities, tools and technique classes only.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Credential Access

T1552 Unsecured Credentials

defense-impairment

T1685 Disable or Modify Tools

Remediation for Microsoft Security Research

Patches

• Apply vendor security updates for takeover-class CVEs as a priority; track KEV for exploited entries

Immediate actions

• Prioritize remediation of remote-takeover vulnerability classes (server-side RCE, authentication bypass, privilege escalation) on internet-exposed systems
• Focus first on exposed systems that hold or reach privileged identities
• Cross-check CISA KEV additions and apply the stated due dates

Workarounds

• Where patching is delayed or impossible (legacy/unsupported systems), reduce exposure via segmentation, access restriction and compensating controls
• Treat credential/secret disclosure flaws as a path to privileged-identity compromise and rotate exposed secrets

Longer-term hardening

• Run external attack surface management to discover internet-facing and previously unknown assets
• Use exposure scoring that goes beyond CVSS when prioritizing patching
• Adopt attack path analysis to connect assets and techniques into end-to-end compromise routes
• Shorten patch cycles for servers, Linux hosts and network appliances, which lag workstations

Affected and fixed versions

• Multiple — Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, developer packages
  Vulnerable versions: Platforms with takeover-class CVEs; no specific versions named

Timeline of Microsoft Security Research

• 1999-01-01 Start of the CVE disclosure period analyzed by Microsoft (approximately 383,000 vulnerabilities disclosed since 1999; date is year-level)
• 2025-12-31 2025 data point: 29% of exploits were launched within one day of CVE publication; mean time from publication to locked-ioc-10 KEV entry was 57 days (year-level date)
• 2026-08-20 Press coverage of locked-ioc-8's 1H 2026 State of Exploitation: 495 KEVs in 1H 2026, 23.43% exploited on or before CVE disclosure, network edge devices most targeted
• 2026-09-30 Data cutoff of Microsoft analysis (CVEs published through September 2026); mean time to locked-ioc-10 KEV entry fell to 20 days in 2026
• 2026-10-30 locked-ioc-10 KEV additions on this date carried a 3-day remediation window (due 2026-11-02) under BOD 26-04, illustrating compressed remediation timelines
• 2026-11-02 locked-ioc-5 publishes the data-driven analysis of exploited vulnerabilities; locked-ioc-10 KEV lists 1,766 entries the same day

Sources cited for Microsoft Security Research

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-02
• CISA KEV catalog JSON feed CISA · Government advisory · 2026-11-02
• VulnCheck: State of Exploitation 1H 2026 vulncheck.com · Research · 2026-08-20
• VulnCheck: 2026 State of Exploitation report wwv.vulncheck.com · Research · 2026-01-01
• What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks (Microsoft Security Research) Microsoft · Blog · 2026-11-02
• GBHackers: Hackers exploit nearly 1 in 4 vulnerabilities before or on disclosure gbhackers.com · News · 2026-08-20

More in threat intel

• Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet Malware
• Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP Takedown
• Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C Family
• NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028
• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys