Hunting CVE 2026 65400 Exploitation On Mac OS

Query

let Days = 30d;
let KnownSHA256 = "84006055916e267f7c2f9324f1848563e589e4526a296d4e9e9ce8e2112d357c";
union
( // 1. Initial access / execution: Root Screen Sharing activity, SSH persistence, masquerading and PF modification.
DeviceInfo| where OSPlatform has 'MacOs' | join kind=inner DeviceProcessEvents on  DeviceId
    | where Timestamp > ago(Days)
    | where
        FileName =~ "SSFileCopyReceiver" or ProcessCommandLine has "sshd-session -i -R" or ProcessCommandLine has "exec -a com.apple.airportd"
        or ProcessCommandLine has "pfctl" or ProcessCommandLine has "com.xmr.miner.plist" or ProcessCommandLine has "sysmond"
    | extend HuntingSignal = case(
        FileName =~ "SSFileCopyReceiver", "Screen Sharing file transfer", ProcessCommandLine has "sshd-session -i -R",
            "SSH remote session activity", ProcessCommandLine has "exec -a com.apple.airportd", "Process masquerading",
        ProcessCommandLine has "pfctl", "Packet Filter modification", ProcessCommandLine has "com.xmr.miner.plist",
            "LaunchDaemon persistence", ProcessCommandLine has "sysmond", "Hidden miner execution", "Suspicious process activity"
    )
    | project Timestamp,DeviceName, ActionType, HuntingSignal, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
),(// 2. File / persistence activity: SSH keys, hidden files, privileged paths and LaunchDaemon persistence
DeviceInfo| where OSPlatform has 'MacOs' | join kind=inner DeviceFileEvents on DeviceId
    | where Timestamp > ago(Days)
    | where SHA256 == KnownSHA256
        or FolderPath has "/private/var/root/.config" or FolderPath has "/Library/LaunchDaemons" or FolderPath has "/private/var/root/.ssh"
    | extend HuntingSignal = case(
        SHA256 == KnownSHA256, "Known XMRig SHA256",
        FolderPath has "/private/var/root/.config", "Hidden root file activity",
        FolderPath has "/Library/LaunchDaemons", "LaunchDaemon activity",
        FolderPath has "/private/var/root/.ssh", "Root SSH activity", "Suspicious file activity"
    )
    | project Timestamp, DeviceName, ActionType, HuntingSignal, FileName, FolderPath, SHA256,
        ProcessCommandLine = InitiatingProcessCommandLine,InitiatingProcessFileName
),
(// 3. Network activity: Observed mining pool plus SSH and Screen Sharing traffic.Ports 22/5900 are context only, not malicious by themselves.
 DeviceInfo| where OSPlatform has 'MacOs' | join kind=inner DeviceNetworkEvents on DeviceId
    | where Timestamp > ago(Days)
    | where RemoteUrl =~ "auto.c3pool.org" or RemotePort in (22, 5900)
    | extend HuntingSignal = case(
        RemoteUrl =~ "auto.c3pool.org", "Observed mining pool",
        RemotePort == 5900, "Screen Sharing / VNC traffic",
        RemotePort == 22, "SSH traffic","Suspicious network activity"
    )
    | project Timestamp, DeviceName, ActionType, HuntingSignal, FileName = InitiatingProcessFileName, FolderPath = "", SHA256 = InitiatingProcessSHA256,
        ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName
)

About this query

Explanation

This KQL query is designed to detect potential exploitation of a vulnerability (CVE-2026-65400) in macOS Screen Sharing service by analyzing telemetry data from Microsoft Defender XDR. Here's a simple breakdown of what the query does:

Time Frame: The query looks at data from the last 30 days.
Known Threat Indicator: It uses a specific SHA256 hash to identify known malicious files related to the XMRig cryptocurrency miner.
Data Sources: The query examines three types of events:
- Process Events: Looks for suspicious processes and commands that indicate unauthorized access or execution, such as Screen Sharing file transfers, SSH sessions, process masquerading, packet filter modifications, and hidden miner execution.
- File Events: Searches for file activities that suggest persistence mechanisms or hidden files, such as SSH keys, hidden root files, and LaunchDaemon activities.
- Network Events: Monitors network traffic for connections to known mining pools and specific ports related to SSH and Screen Sharing.
Hunting Signals: For each type of event, the query assigns a "Hunting Signal" label to categorize the suspicious activity, making it easier to identify and investigate potential threats.
Output: The query outputs relevant details like timestamp, device name, action type, hunting signal, file name, folder path, SHA256 hash, and process command line for each detected event.

Overall, this query helps security analysts identify and investigate signs of exploitation related to CVE-2026-65400 on macOS devices by focusing on specific indicators of compromise across process, file, and network activities.