###############################################################################
#
#  ThreatHunter.ai - July 2026 Patch Tuesday Hunt Pack
#  Version: 2026-07-14   |   License: MIT   |   https://threathunter.ai
#
#  3 free Sigma detection rules for the exploited and high-signal flaws in the
#  July 2026 Patch Tuesday release (570 fixes). Single-file edition: every rule
#  below is a standard Sigma document separated by "---". Works as-is with the
#  Sigma CLI:
#
#      pip install sigma-cli
#      sigma plugin install splunk        # or sentinel, elasticsearch, qradar
#      sigma convert -t splunk threathunter-july-2026-patch-tuesday-pack.yml
#
#  All three rules import straight into Argillite.
#
# ---------------------------------------------------------------------------
#  WHY THIS PACK EXISTS
# ---------------------------------------------------------------------------
#  Two flaws in this cycle are confirmed exploited in attacks:
#
#    CVE-2026-56164  SharePoint Server EoP, missing authentication for a
#                    critical function, unauthorized attacker over the network.
#                    Microsoft rated it MODERATE. Patch it anyway.
#    CVE-2026-56155  AD FS EoP, insufficient granularity of access control.
#                    "Local" on an AD FS box is a full federated identity
#                    compromise.
#
#  And one publicly disclosed flaw everyone will scroll past:
#
#    CVE-2026-50661  BitLocker security feature bypass requiring physical
#                    access. Every lost-laptop conversation assumed BitLocker
#                    was holding the line.
#
#  Microsoft has not published exploitation details for the exploited flaws, so
#  these are BEHAVIORAL HUNTS, not exploit signatures. They look for the outcome
#  instead of the mechanics, and they will fire on legitimate admin work in some
#  environments. Tune them against your own baseline before you promote them out
#  of a hunting queue.
#
#  Author: James McMurry, ThreatHunter.ai
#
###############################################################################
---
title: Suspicious Child Process from SharePoint IIS Worker Process
id: 8f2b1c40-3d7e-4a91-b6c2-1e5a9d0f7c31
status: experimental
description: >
  Detects w3wp.exe hosting a SharePoint application pool spawning command
  interpreters or script hosts. Written as a post-exploitation hunt for
  CVE-2026-56164, a Microsoft SharePoint Server elevation of privilege flaw
  that Microsoft describes as missing authentication for a critical function,
  exploitable by an unauthorized attacker over the network, and confirmed
  exploited in attacks as of the July 2026 Patch Tuesday release. Microsoft
  has not published exploitation details, so this rule targets the outcome of
  successful exploitation rather than the delivery mechanism.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
author: James McMurry, ThreatHunter.ai
date: 2026/07/14
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.persistence
  - attack.t1505.003
  - cve.2026.56164
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains:
      - 'SharePoint'
      - 'SecurityTokenServiceApplicationPool'
      - '_layouts'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
  filter_known_good:
    Image|endswith:
      - '\Microsoft Shared\Web Server Extensions\16\BIN\stsadm.exe'
      - '\Microsoft Shared\Web Server Extensions\15\BIN\stsadm.exe'
  condition: selection_parent and selection_child and not filter_known_good
fields:
  - ComputerName
  - User
  - ParentCommandLine
  - CommandLine
  - IntegrityLevel
falsepositives:
  - SharePoint timer jobs and provisioning workflows that legitimately shell out
  - Farm administrators running maintenance scripts through the web tier
  - Monitoring and backup agents that instrument the application pool
level: high
---
title: AD FS Service Host Anomalous Behavior or Token Signing Key Access
id: c47e9a12-6b83-4f52-9d0a-72c3b8e15f6d
status: experimental
description: >
  Detects child process execution from the AD FS service host and access to AD FS
  token signing material or configuration. Written as a post-exploitation hunt for
  CVE-2026-56155, an Active Directory Federation Services elevation of privilege
  flaw caused by insufficient granularity of access control, confirmed exploited
  in attacks in the July 2026 Patch Tuesday release. Successful exploitation on an
  AD FS server
  should be treated as a path to federated identity compromise, because control
  of the token signing key allows an attacker to mint tokens for any relying party.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
author: James McMurry, ThreatHunter.ai
date: 2026/07/14
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.credential_access
  - attack.t1552.004
  - attack.t1606.002
  - attack.defense_evasion
  - cve.2026.56155
logsource:
  category: process_creation
  product: windows
detection:
  selection_adfs_child:
    ParentImage|endswith:
      - '\Microsoft.IdentityServer.ServiceHost.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  selection_key_access:
    CommandLine|contains:
      - 'Get-AdfsCertificate'
      - 'Set-AdfsCertificate'
      - 'Export-AdfsDeploymentSQLScript'
      - 'Get-AdfsProperties'
      - 'Set-AdfsProperties'
      - 'Add-AdfsClient'
      - 'Set-AdfsClient'
      - 'Add-AdfsRelyingPartyTrust'
      - 'Set-AdfsRelyingPartyTrust'
      - 'Add-AdfsClaimsProviderTrust'
      - 'Update-AdfsCertificate'
      - 'Get-AdfsSslCertificate'
      - 'AdfsDkm'
  selection_dump_tooling:
    CommandLine|contains:
      - 'AADInternals'
      - 'Export-AADIntADFSSigningCertificate'
      - 'Get-AADIntADFSConfiguration'
      - 'ADFSDump'
  filter_known_good:
    User|contains:
      - 'ADFS_SVC'
    ParentImage|endswith:
      - '\SMSvcHost.exe'
  condition: (selection_adfs_child or selection_key_access or selection_dump_tooling) and not filter_known_good
fields:
  - ComputerName
  - User
  - ParentImage
  - CommandLine
  - IntegrityLevel
falsepositives:
  - Scheduled certificate rollover performed by farm administrators
  - Documented AD FS configuration changes during migration or onboarding work
  - Configuration management tooling that drives AD FS through PowerShell
level: high
---
title: BitLocker Protection Disabled, Suspended, or Recovery Key Exposure
id: 5a6d0e73-91cf-4b28-8e14-c0f7a2b6d493
status: experimental
description: >
  Detects BitLocker being disabled or suspended, boot configuration changes that
  weaken pre-boot integrity, and recovery key retrieval. Written as a defensive
  hunt around CVE-2026-50661, a publicly disclosed Windows BitLocker security
  feature bypass that allows an attacker with physical access to reach data on
  an encrypted system storage device, addressed in the July 2026 Patch Tuesday
  release. A pure offline physical attack will not generate host telemetry, so
  this rule covers the adjacent activity that precedes, enables, or follows such
  an attack, including insider staging and post-recovery tampering.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661
author: James McMurry, ThreatHunter.ai
date: 2026/07/14
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1542.001
  - attack.credential_access
  - attack.t1555
  - cve.2026.50661
logsource:
  category: process_creation
  product: windows
detection:
  selection_managebde:
    Image|endswith: '\manage-bde.exe'
    CommandLine|contains:
      - '-off'
      - '-protectors -disable'
      - '-pause'
      - '-recoverypassword'
      - '-forcerecovery'
  selection_powershell:
    CommandLine|contains:
      - 'Disable-BitLocker'
      - 'Suspend-BitLocker'
      - 'Get-BitLockerVolume'
      - 'BackupToAAD-BitLockerKeyProtector'
      - 'Remove-BitLockerKeyProtector'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'testsigning'
      - 'nointegritychecks'
      - 'bootstatuspolicy'
      - 'recoveryenabled'
      - 'safeboot'
      - '/set {bootmgr}'
  selection_reagentc:
    Image|endswith: '\reagentc.exe'
    CommandLine|contains:
      - '/disable'
      - '/setosimage'
      - '/boottore'
  filter_known_good:
    ParentImage|endswith:
      - '\TrustedInstaller.exe'
      - '\CcmExec.exe'
      - '\MsiExec.exe'
  condition: 1 of selection_* and not filter_known_good
fields:
  - ComputerName
  - User
  - ParentImage
  - CommandLine
falsepositives:
  - Firmware and BIOS updates that legitimately suspend BitLocker for one reboot
  - Imaging, provisioning, and OS upgrade workflows driven by SCCM or Intune
  - Help desk staff performing authorized recovery on a locked out user
level: medium
