# Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World Attacks

> Microsoft analysis of ~383,000 CVEs published through September 2026 finds only ~0.5% (about 2,000) linked to real-world exploitation, concentrated in takeover-class flaws (server-side RCE, local privilege escalation, client-side RCE). 29% of 2025 exploits were launched within one day of CVE publication.

- **Published:** 2026-11-02T22:03:54Z
- **Last reviewed:** 2026-11-02T22:03:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5099
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5099.png
- **ID:** TL-2026-5099
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

On 2026-11-02 Microsoft Security Research (Yair Tsarfaty, Or Begam) published an aggregate analysis of Microsoft's catalog of tracked vulnerabilities covering CVEs published through September 2026. Of roughly 383,000 software vulnerabilities disclosed since 1999, about 2,000 (0.5%) are linked to real-world exploitation; the study counts 2,056 exploited CVEs. 77% of all CVEs affect application code and 23% operating systems, but exploited CVEs skew to operating-system code (41%).

Each CVE was classified by its consequential security outcome rather than its stated class. Server-side RCE accounts for 37% of exploited CVEs (vs. 20% of all published CVEs), local privilege escalation 18% (vs. 11%), client-side RCE 13% (vs. 4%). XSS (4% exploited vs. 15% published) and denial of service (7% vs. 16%) are under-represented among exploited flaws. Takeover vulnerabilities (RCE, authentication bypass, privilege escalation) make up 78% of exploited CVEs. Windows and Linux/Unix are the most affected platforms; 1,239 exploited remote-takeover CVEs were analyzed across platforms (Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts, developer packages).

Exploitation velocity: 29% of exploits in 2025 were launched within one day of CVE publication; the mean time from publication to CISA KEV entry was 57 days in 2025 and 20 days in 2026 through September, with a median of 3 days. AI-assisted discovery is cited as an accelerating factor. Reported patching timelines in 2026 are about 2 weeks for Windows workstations, over 1 month for Windows servers, 10+ weeks for Linux servers and macOS applications, and over 1 year for network appliances.

The article names no CVEs, threat actors, malware families or network indicators. Its defensive guidance: prioritize remote-takeover classes first; treat DoS on availability-critical assets and credential/secret disclosure feeding privileged-identity compromise as secondary priorities; focus on exposed systems with privileged identities; use external attack surface management, exposure scoring beyond CVSS and attack path analysis, since patching can take weeks or months and some legacy systems cannot be patched. Cited data sources include VulnCheck's State of Exploitation 2026, CISA KEV data and CVE.org metrics. Corroborating context: VulnCheck's 1H 2026 report identified 495 KEVs in the first half of 2026, 23.43% with evidence of exploitation on or before CVE disclosure, with network edge devices (firewalls, VPNs, proxies) the most targeted technologies. The CISA KEV catalog listed 1,766 entries as of 2026-11-02 and is governed by BOD 26-04.

This is a research/context item, not an active campaign; indicators in this record are entities, tools and technique classes only.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5099 Server-Side RCE — Web Server Process Spawning Shell or Recon Tool (T1190, T1059, T1505, T1033)** (`TL-2026-5099-SPL-001`)

Detects web server worker processes (w3wp.exe, httpd.exe, nginx.exe, php-cgi.exe, Tomcat) spawning cmd, PowerShell, script hosts, downloaders or operator recon utilities (whoami, net, nltest, systeminfo). Server-side RCE is the largest exploited-CVE class (37%) in the Microsoft analysis and network edge/web-facing systems are the most targeted technologies in VulnCheck 1H 2026 data; regardless of the CVE, successful exploitation or a dropped web shell produces this parent-child pattern. Maps to T1190, T1059, T1505 and T1033.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1505, T1033
- **Data sources:** sysmon, microsoft_defender_endpoint:DeviceProcessEvents, sigma:windows/process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\w3wp.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\tomcat*.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\curl.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe" OR Image="*\\systeminfo.exe" OR Image="*\\ipconfig.exe" OR Image="*\\tasklist.exe" OR Image="*\\hostname.exe" OR Image="*\\quser.exe")
```Web server worker spawning a shell, downloader or recon utility indicates server-side RCE exploitation or web shell execution (T1190, T1059, T1505, T1033)```
| eval child=lower(Image), recon=if(match(child,"(whoami|net1?|nltest|systeminfo|ipconfig|tasklist|hostname|quser)\\.exe$"),1,0), shell=if(match(child,"(cmd|powershell|pwsh|wscript|cscript|mshta)\\.exe$"),1,0)
| stats count sum(recon) as recon_children sum(shell) as shell_children min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_command_lines values(Image) as child_images by host ParentImage ParentCommandLine User
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5099", mitre="T1190,T1059,T1505,T1033", exploit_class="server-side RCE", webshell_suspect=if(shell_children>0 AND recon_children>0,"yes","no")
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "tomcat8.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "systeminfo.exe", "ipconfig.exe", "tasklist.exe", "hostname.exe", "quser.exe")
| extend Technique = case(FileName in~ ("whoami.exe", "net.exe", "net1.exe", "nltest.exe", "systeminfo.exe", "ipconfig.exe", "tasklist.exe", "hostname.exe", "quser.exe"), "T1033 discovery from web worker", "T1059 command execution from web worker")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Technique
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server Worker Process Spawning Shell or Recon Utility
id: 7c1b3e52-4a8d-4f21-9b6e-1d2a3c4e5f01
status: experimental
description: Detects a web server worker process (IIS, Apache, Nginx, PHP-CGI, Tomcat) spawning a shell, downloader or reconnaissance utility, the classic child-process signature of server-side RCE exploitation (T1190), web shell execution (T1505.003), command interpreter use (T1059) and operator discovery (T1033) described in the Microsoft takeover-class vulnerability analysis
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - https://www.vulncheck.com/blog/state-of-exploitation-1h-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
    - attack.discovery
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\tomcat8.exe'
            - '\tomcat9.exe'
            - '\tomcat10.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\systeminfo.exe'
            - '\ipconfig.exe'
            - '\tasklist.exe'
            - '\hostname.exe'
            - '\quser.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate web applications that shell out to helper executables
    - Administrative maintenance scripts launched by the web server service
level: high

```

**Known false positives:**

- Legitimate web applications that invoke helper executables such as certutil or curl for scheduled tasks
- Administrators using web-hosted management consoles that spawn cmd.exe
- Deployment or health-check scripts run by an application pool identity

**Tuning notes:** Allow-list known application pool identities and exact CommandLine values of sanctioned helper scripts. Scope to internet-facing web servers first; raise severity when webshell_suspect=yes (shell and recon children from the same parent) or the child runs as a service identity with network egress.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5099 Client-Side RCE — Office, PDF Reader or Browser Spawning Script Interpreter (T1203, T1059, T1218) (locked: unlock with TL Creds)
- TL-2026-5099 Defense Impairment — Defender, Logging and Firewall Tampering (T1562, T1070, T1059) (locked: unlock with TL Creds)
- TL-2026-5099 Unsecured Credentials — Credential File, Registry and Vault Hunting (T1552, T1555, T1083) (locked: unlock with TL Creds)
- TL-2026-5099 Exploit Public-Facing Application — Traversal/Command Injection in Web Requests (T1190, T1059, T1083) (locked: unlock with TL Creds)
- TL-2026-5099 Unsecured Credentials — Instance Metadata Service Token Theft (T1552, T1528, T1078) (locked: unlock with TL Creds)
- TL-2026-5099 Endpoint DoS / Failed Exploitation — Crashes of Exposed Services (T1499, T1190, T1210) (locked: unlock with TL Creds)
- TL-2026-5099 Local Privilege Escalation — SYSTEM Shell from User-Writable Non-SYSTEM Parent (T1068, T1134, T1059) (locked: unlock with TL Creds)
- TL-2026-5099 Remote Service Exploitation — Network Fan-Out on SMB/RPC/RDP/WinRM (T1210, T1021, T1046) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks (Microsoft Security Research)](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA KEV catalog JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [VulnCheck: State of Exploitation 1H 2026](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026)
- [VulnCheck: 2026 State of Exploitation report](https://wwv.vulncheck.com/state-of-exploitation-2026-report)
- [GBHackers: Hackers exploit nearly 1 in 4 vulnerabilities before or on disclosure](https://gbhackers.com/hackers-exploit-nearly-1-in-4-vulnerabilities/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5099