CVE2022

CVE-2022-26809

1Rules

4References

1Folders

2023-02-03Latest

Summary

CVE-2022-26809 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threathightest

Potential CVE-2022-26809 Exploitation Attempt

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

WindowsProcess Creation

TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0002 · ExecutionT1569.002 · Service Execution+2

Florian Roth (Nextron Systems)Wed Apr 132022

References