KQL Search

# *Potential CVE-2026-41089 Exploit Attempt on Domain Controllers*

## Query Information

#### MITRE ATT&CK Technique(s)

| Technique ID | Title    | Link    |
| ---  | --- | --- |
| T1021 | Remote Services | https://attack.mitre.org/techniques/T1021 |


#### Description

This rule detects potential exploitation attempts targeting CVE-2026-41089 on Domain Controllers. It identifies inbound network connections to common RPC/SMB ports (135, 445, and dynamic RPC ports 49152-65535) on devices identified as Domain Controllers. The detection specifically looks for these connections originating from 'svchost.exe' with command lines containing 'netlogon' or 'netsvcs', and flags if the target Domain Controller is known to be vulnerable to CVE-2026-41089. A high severity is assigned if the connection count is 10 or more, or if the target DC is vulnerable.

#### Author <Optional>
- **Name: Benjamin Zulliger**
- **Github: https://github.com/benscha/KQLAdvancedHunting**
- **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/**

#### References
- https://www.penligent.ai/hackinglabs/cve-2026-41089/


## Defender XDR
```KQL
// CVE-2026-41089 Exploit Detection
let ExcludedRemoteIPs = dynamic(["0.0.0.0"]); //Define excluded IPs
let DomainControllers = 
    ExposureGraphNodes
    | where set_has_element(Categories, "device")
    | extend DeviceRoles = parse_json(NodeProperties.rawData.deviceRole)
    | where DeviceRoles contains "DomainController"
    | project DeviceName = tolower(NodeName);
let VulnerableDCs =
    DeviceTvmSoftwareVulnerabilities
    | where CveId == "CVE-2026-41089"
    | project DeviceName = tolower(DeviceName);
DeviceNetworkEvents
| where Timestamp > ago(7d) 
| where ActionType == "InboundConnectionAccepted"
| where LocalPort in (135, 445, 49672) 
    or (LocalPort >= 49152 and LocalPort <= 65535)
| where RemoteIP !in (ExcludedRemoteIPs)
| extend LowerDeviceName = tolower(DeviceName)
| where LowerDeviceName in (DomainControllers)
| extend IsVulnerable = iff(LowerDeviceName in (VulnerableDCs), true, false)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine has_any ("netlogon", "netsvcs")
| summarize 
    ConnectionCount = count(),
    TargetPorts = make_set(LocalPort),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, RemoteIP, IsVulnerable
| where ConnectionCount >= 3 
| extend 
    IsExternal = not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")),
    Severity = iff(ConnectionCount >= 10 or IsVulnerable == true, "High", "Medium")
| project-reorder FirstSeen, LastSeen, DeviceName, IsVulnerable, Severity, ConnectionCount, RemoteIP, TargetPorts, IsExternal
| sort by ConnectionCount desc

```