Inferlume

title: Chrome WebGPU Exploit — Suspicious Child Process (CVE-2026-5281)
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: >
  Detects Chromium-based browser processes spawning shell or scripting
  interpreters. Consistent with post-sandbox-escape behavior following
  exploitation of CVE-2026-5281 (Dawn WebGPU UAF).
  Apply on Windows endpoint process-creation telemetry.
references:
  - CVE-2026-5281
author: CTI Daily v2.0
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1203
  - attack.defense_evasion
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_legitimate:
    # Chrome legitimately spawns crash handlers and updaters — exclude known-good
    Image|endswith:
      - '\chrome_crashpad_handler.exe'
      - '\GoogleUpdate.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Enterprise browser extensions spawning helper scripts — review per environment
  - Automated testing frameworks using Chromium
level: high

rule Chrome_Dawn_WebGPU_UAF_Artifact {
    /*
     * Detects memory artifacts consistent with Chrome Dawn WebGPU UAF
     * exploitation (CVE-2026-5281). Apply against Chrome crash dumps,
     * suspicious files dropped by browser processes, or memory captures
     * from high-risk endpoints. Pattern is indicative, not definitive —
     * corroborate with process behaviour alerts.
     */
    meta:
        description = "Chrome Dawn WebGPU UAF exploit artifact (CVE-2026-5281)"
        author      = "CTI Daily v2.0"
        date        = "2026-04-15"
        reference   = "CVE-2026-5281"
        severity    = "high"

    strings:
        // Dawn WebGPU API strings present in renderer exploitation context
        $dawn_device  = "dawn::native::Device" ascii
        $gpu_buffer   = "GPUBuffer" wide ascii
        $wgpu_create  = "wgpuDeviceCreateBuffer" ascii

        // Generic heap spray / UAF exploitation markers
        // High FP rate in isolation — require corroboration with Dawn strings
        $heap_a  = { 41 41 41 41 41 41 41 41 }   // 'AAAAAAAA' heap spray
        $heap_b  = { 0D 0D 0D 0D 0D 0D 0D 0D }   // 0x0D sled pattern
        $nop_sled = { 90 90 90 90 90 90 90 90 90 90 }  // NOP sled

    condition:
        // Dawn API strings present + at least one exploit-pattern marker
        2 of ($dawn_device, $gpu_buffer, $wgpu_create)
        and 1 of ($heap_a, $heap_b, $nop_sled)
}

// SIEM Pseudocode — Chrome Version Floor Enforcement (CVE-2026-5281)
// Source:  Endpoint software inventory telemetry
// Safe floor: Chrome >= 146.0.7680.177 / 146.0.7680.178

FROM endpoint_software_inventory
WHERE
    software_name IN (
        'Google Chrome',
        'Microsoft Edge',
        'Brave Browser',
        'Opera'
    )
    AND software_version < '146.0.7680.177'    -- Vulnerable version floor
    AND last_seen >= NOW() - 24h               -- Active assets only
GROUP BY
    host_name,
    software_name,
    software_version,
    user_name,
    last_seen
ORDER BY last_seen DESC

-- Alert on ANY result = unpatched browser still present
-- Priority: CRITICAL — CISA KEV deadline was 2026-04-15
-- Action: Trigger automated patch push OR create analyst remediation case

title: SharePoint Master Page / Site Asset Modification by Non-Admin (CVE-2026-32201)
id: b2c3d4e5-f6a7-8901-bcde-f01234567891
status: experimental
description: >
  Detects non-privileged accounts modifying SharePoint master pages, layouts,
  or SiteAssets. Consistent with content spoofing exploitation of CVE-2026-32201
  (SharePoint Server spoofing zero-day).
author: CTI Daily v2.0
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.impact
  - attack.t1565.002
logsource:
  product: windows
  service: sharepoint_uls    # SharePoint ULS audit log / Unified Logging Service
detection:
  selection:
    EventType:
      - 'ContentModified'
      - 'FileUploaded'
      - 'ScriptInjected'
    TargetPath|contains:
      - '/_catalogs/masterpage'
      - '/_layouts'
      - '/SiteAssets/'
  filter_admins:
    # Exclude farm and site admins performing authorised deployments
    UserRole:
      - 'FarmAdmin'
      - 'SiteAdmin'
  condition: selection and not filter_admins
falsepositives:
  - Developers deploying approved design changes in dev/staging environments
  - SharePoint migration or publishing workflows with non-admin service accounts
level: high

// SIEM Pseudocode — SharePoint Exploit Reconnaissance Pattern (CVE-2026-32201)
// Source:  SharePoint web front-end IIS access logs
// Logic:   Spike in 4xx errors from a single IP followed by 200-series
//          successes on sensitive paths — consistent with exploitation probing

FROM sharepoint_web_access_logs
WHERE
    timestamp BETWEEN '2026-04-01' AND NOW()   -- Review window post first-observed date
GROUP BY
    client_ip,
    target_path
HAVING
    COUNT(CASE WHEN http_status BETWEEN 400 AND 499 THEN 1 END) > 5
    AND COUNT(CASE WHEN http_status BETWEEN 200 AND 299 THEN 1 END) > 1
    AND (
        target_path LIKE '%/_catalogs/%'
        OR target_path LIKE '%/_layouts/%'
        OR target_path LIKE '%/SiteAssets/%'
    )
ORDER BY COUNT(*) DESC

-- Alert: Any client_ip matching this pattern against sensitive paths
-- Priority: HIGH
-- Tag: T1190 / CVE-2026-32201

title: Defender Platform EoP — WinDefend Service Privileged Object Access (CVE-2026-33825)
id: c3d4e5f6-a7b8-9012-cdef-012345678912
status: experimental
description: >
  Detects medium-integrity (standard-user) processes accessing or manipulating
  WinDefend service objects in ways inconsistent with normal Defender operation.
  Consistent with privilege escalation via CVE-2026-33825.
author: CTI Daily v2.0
date: 2026/04/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: windows
  service: security
detection:
  selection_svc_access:
    EventID:
      - 4673    # Sensitive privilege used
      - 4674    # Operation attempted on privileged object
    ObjectName|contains: 'WinDefend'
  filter_legit_processes:
    # Exclude Defender's own service processes
    ProcessName|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'
      - '\SecurityHealthService.exe'
      - '\MsSense.exe'
  selection_svc_install:
    EventID:
      - 4697    # Service installed in system
      - 7045    # New service installed (System log)
    ServiceName|contains: 'WinDefend'
    SubjectIntegrityLevel: 'Medium'    # Unexpected: standard user installing service
  condition: >
    (selection_svc_access and not filter_legit_processes)
    or selection_svc_install
falsepositives:
  - Third-party AV management tools interacting with Defender service
  - Legitimate administrative scripts performing Defender policy configuration
level: high

title: Domain Controller Anomalous Process Creation (CVE-2026-33826)
id: d4e5f6a7-b8c9-0123-def0-123456789013
status: experimental
description: >
  Detects unexpected process creation on domain controllers from non-standard
  parent processes or initiated by non-machine accounts. Consistent with
  adjacent-network RCE exploitation of CVE-2026-33826.
author: CTI Daily v2.0
date: 2026/04/15
tags:
  - attack.lateral_movement
  - attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    EventID: 4688
    SubjectUserName|not_endswith: '$'    # Exclude machine accounts
    NewProcessName|contains:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
    ParentProcessName|not_endswith:
      - '\services.exe'
      - '\wininit.exe'
      - '\lsm.exe'
      - '\svchost.exe'
  filter_known_admin_hosts:
    # Scope to domain controllers — set ComputerName to actual DC list
    ComputerName|endswith: '-DC'    # Adjust to environment naming convention
  condition: selection and filter_known_admin_hosts
falsepositives:
  - Legitimate administrative scripts running on DCs via jump host
  - Monitoring agents spawning diagnostic processes
level: critical

// SIEM Pseudocode — New Service on DC from Non-Standard Host (CVE-2026-33826)
// Source:  Windows Security Event Log (Event ID 7045 / 4697), DC-forwarded
// Logic:   Detect new services installed on DCs where initiating host
//          is NOT on the approved admin jump host list

FROM windows_event_logs
WHERE
    event_id IN (7045, 4697)                          -- Service installation events
    AND computer_name IN (domain_controller_list)     -- Scoped to DCs only
    AND initiating_host NOT IN (approved_admin_hosts) -- Not from jump host / mgmt station
    AND subject_user_name NOT LIKE '%$'               -- Not machine account
    AND timestamp >= NOW() - 24h

UNION

FROM windows_security_events
WHERE
    event_id = 4688                                   -- Process creation
    AND computer_name IN (domain_controller_list)
    AND new_process_name LIKE '%\TEMP\%'              -- Process executing from temp
    AND timestamp >= NOW() - 24h

ORDER BY timestamp DESC

-- Alert: CRITICAL on any DC result
-- Tag: T1210 / Lateral Movement
-- Escalation: Immediate analyst review; isolate DC from non-DC segment if confirmed