Client-side and Kernel Vulnerability Monitoring

Source

---
analysis: A single detection rule may flag the software version or the shell execution,
  but this hunt combines vulnerability exposure with fleet-wide behavioral baselining
  to distinguish legitimate installer activity from malicious hijacking.
blind_spots:
- id: missing-vulnerability-data
  question: whether a host is vulnerable if it has not been scanned recently
  requires: hb_vulnerability_finding or hb_software_inventory
  risk: A host may appear safe because of a stale scan, causing the gate to close
    prematurely.
- id: kernel-irp-telemetry
  question: whether malformed packets were sent to netio.sys or tcpip.sys
  requires: Kernel-level IRP or API monitoring
  risk: Kernel exploitation may occur without spawning new processes, making it invisible
    to process telemetry unless a driver is replaced.
  stage: privilege-escalation-windows-kernel
- id: no-agent-coverage
  question: whether exploitation is occurring on unmanaged devices
  requires: Endpoint agent on all targeted OS versions
  risk: Gaps in agent deployment mean large portions of the estate are unmonitored
    for behavior.
coverage:
- stage: client-execution-foxit-pdf
  status: covered
  steps:
  - vulnerability-lead
  - rare-suspicious-child-processes
- stage: privilege-escalation-adobe-installer
  status: covered
  steps:
  - vulnerability-lead
  - installer-dll-anomalies
- stage: privilege-escalation-windows-kernel
  status: covered
  steps:
  - vulnerability-lead
  - unusual-driver-activity
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Exploiting unpatched client-side and kernel-mode vulnerabilities
    are primary vectors for initial access and privilege escalation. Confirming whether
    vulnerable software is present and actively being exploited is essential for risk
    prioritization.
  methodology: model-assisted
  trigger: intel-report
hypothesis: Adversaries are exploiting unpatched vulnerabilities in client applications
  like Foxit Reader and Adobe Photoshop, or Windows kernel drivers like netio.sys
  and tcpip.sys, to execute code or elevate privileges.
labels:
- hunt
- attack.t1190
- attack.t1203
- attack.t1574.001
- attack.t1068
- execution
- privilege escalation
name: Client-side and Kernel Vulnerability Monitoring
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine for behavioral evidence.
    from:
      kind: manual
      observed: '2026-10-07'
      ref: standard-lookback
    type: number
  scope_hosts:
    default: []
    description: List of hostnames to focus the behavioral investigation; defaults
      to all hosts if empty.
    from:
      kind: manual
      observed: '2026-10-07'
      ref: analyst-scoping
    type: list[host]
  suspicious_interpreters:
    default:
    - cmd.exe
    - powershell.exe
    - pwsh.exe
    - wscript.exe
    - cscript.exe
    - bash.exe
    - python.exe
    description: Common shells or interpreters often spawned during successful exploitation.
    from:
      kind: manual
      observed: '2026-10-07'
      ref: common-shells
    type: list[string]
  target_cves:
    default:
    - CVE-2026-48388
    - CVE-2026-49177
    - CVE-2026-50475
    - CVE-2026-57256
    - CVE-2026-58613
    - CVE-2026-80093
    - CVE-2026-91799
    description: List of CVE IDs from the Talos research paper.
    from:
      kind: article
      observed: '2026-10-07'
      ref: talos-2026-10-07
    type: list[string]
  target_drivers:
    default:
    - netio.sys
    - tcpip.sys
    - cldflt.sys
    description: System drivers named in the research to monitor for non-standard
      loads.
    from:
      kind: article
      observed: '2026-10-07'
      ref: talos-2026-10-07
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Start with workstations running Foxit Reader and Adobe Photoshop. Focus
  on hosts identified by the lead query as having unpatched CVEs. Widen the scope
  to include any server running vulnerable Windows kernel builds if the driver behavioral
  query yields results.
references:
- name: "Cisco Talos \u2014 Microsoft, Adobe, Apple, and Foxit vulnerabilities"
  url: https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/
related:
- hunt: unusual-dll-load-events
  reason: Search path hijacking can also be detected by hb_module_activity, but that
    surface is higher volume.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Foxit Reader RCE via JavaScript
    observables:
    - Foxit Reader version 2026.1.1.36485
    - malformed PDF document
    - JavaScript checkbox CBF_Widget operations
    - Array object memory corruption
    slug: client-execution-foxit-pdf
    tactic: execution
    techniques:
    - T1203
  - name: Adobe Photoshop Installer Search Path Hijacking
    observables:
    - Photoshop_Set-Up.exe version 2.11.0.30
    - malicious library file placement in installer directory
    - CVE-2026-48388
    slug: privilege-escalation-adobe-installer
    tactic: privilege-escalation
    techniques:
    - T1574.001
  - name: Windows Kernel Driver Exploitation
    observables:
    - netio.sys
    - tcpip.sys
    - Windows Cloud Files Mini Filter Driver version 10.0.26100.8457
    - Cloud Filter API calls
    - crafted I/O request packets (IRP)
    - dedicated application to trigger driver vulnerability
    slug: privilege-escalation-windows-kernel
    tactic: privilege-escalation
    techniques:
    - T1068
  summary: This research details multiple critical vulnerabilities in Adobe Photoshop,
    Foxit Reader, and Windows kernel components that enable remote code execution
    and local privilege escalation. Attackers can exploit these flaws through malformed
    PDF files containing JavaScript, hijacked search paths during software installation,
    or crafted I/O request packets targeting system drivers.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# Client-side and Kernel Vulnerability Monitoring

This hunt identifies potential exploitation of several 2026 vulnerabilities in Foxit Reader, Adobe Photoshop, and Windows kernel drivers. It uses a gated flow, first identifying hosts with known vulnerable versions before launching behavioral queries to find rare child processes, unauthorized DLL writes in installer paths, and system drivers loading from non-standard directories. By correlating vulnerability state with behavioral anomalies, the hunt distinguishes between general software presence and active exploitation attempts.

## vulnerability-lead
<!-- Vulnerable host scoping -->
Identify hosts with active vulnerability findings for the CVEs mentioned in the research to justify further behavioral analysis.

```sqlite target=endpoint role=scoping params=(target_cves=target_cves)
~~~yaml
expected: A list of device_uids that currently possess the vulnerabilities. Silence
  means no known vulnerable software is reporting to the vulnerability surface.
reads:
- device_uid
- cve_uid
- affected_package_name
- affected_package_version
- severity
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'
```

## gate-assessment
<!-- Assess vulnerability exposure -->
```agent target=hunter
cite: required
context:
- vulnerability-lead
max_iterations: 3
objective: Determine if any enrolled hosts are at high risk due to the target CVEs.
success_criteria: A per-host vulnerability summary citing the scoping rows.
tools:
- endpoint
```

## exposure-gate
<!-- Gate on vulnerability presence -->
if~: "The gate-assessment indicates at least one host has an active, unsuppressed target CVE." (confidence: high, judge=hunter)
then: → behavioral-fanout
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: missing-vulnerability-data)
else: → close-out

## behavioral-fanout
<!-- Behavioral evidence fan-out -->
parallel:
- → rare-suspicious-child-processes
- → installer-dll-anomalies
- → unusual-driver-activity
join: → triage-verdict

## rare-suspicious-child-processes
<!-- Rare suspicious child processes -->
Detect shells or interpreters spawned by Foxit Reader or the Adobe installer that are rare across the fleet and help distinguish exploitation from legitimate activity.

```sqlite target=endpoint role=baseline params=(suspicious_interpreters=suspicious_interpreters, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Processes like cmd.exe appearing as children of Foxit Reader on very few
  hosts. Silence means no suspicious child processes were detected.
prevalence:
  by: device_hostname
  key:
  - process_name
  - parent_process_name
  rare_below: 3
reads:
- device_hostname
- process_name
- process_original_file_name
- process_cmd_line
- parent_process_name
- parent_process_cmd_line
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%foxitreader.exe' OR LOWER(parent_process_name) LIKE '%photoshop_set-up.exe') AND (instr(',' || '{{suspicious_interpreters}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line HAVING hosts < 3
```

## installer-dll-anomalies
<!-- Installer search-path DLL anomalies -->
Detect DLL creation by the Adobe installer in unexpected locations, specifically targeting search-path hijacking (CVE-2026-48388).

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: DLL files created by the installer in its own directory or other non-temporary,
  user-writable locations. Silence indicates standard installer behavior.
reads:
- device_hostname
- process_name
- file_path
- file_name
- activity_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, process_name, file_path, file_name, activity_name, time FROM hb_file_activity WHERE LOWER(process_name) LIKE '%photoshop_set-up.exe' AND activity_id = 1 AND LOWER(file_name) LIKE '%.dll' AND LOWER(file_path) NOT LIKE '%\\appdata\\local\\temp\\%' AND LOWER(file_path) NOT LIKE '%\\windows\\temp\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## unusual-driver-activity
<!-- Suspicious kernel driver load paths -->
Identify loads of sensitive system drivers from non-standard directories using hb_module_activity as a proxy for kernel-mode loads.

```sqlite target=endpoint role=baseline params=(target_drivers=target_drivers, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Sensitive system drivers loading from locations other than the standard
  drivers directory. Silence means these drivers are only loading from their expected
  paths.
reads:
- device_hostname
- module_name
- module_path
- module_signature_status
- time
silence: not_evidence_of_absence
source: hb_module_activity
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, module_name, module_path, module_signature_status, time FROM hb_module_activity WHERE instr(',' || '{{target_drivers}}' || ',', ',' || LOWER(module_name) || ',') > 0 AND LOWER(module_path) NOT LIKE 'c:\\windows\\system32\\drivers\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## triage-verdict
<!-- Final evidence triage -->
```agent target=hunter
cite: required
context:
- gate-assessment
- rare-suspicious-child-processes
- installer-dll-anomalies
- unusual-driver-activity
max_iterations: 6
objective: Determine if any vulnerable hosts show signs of successful exploitation
  based on rare child processes, DLL hijacking, or unusual kernel driver activity.
success_criteria: A final verdict citing specific rows and the vulnerability status
  of each host.
tools:
- endpoint
```

## route-verdict
<!-- Route on triage verdict -->
if~: "The triage-verdict is malicious for at least one host." (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-agent-coverage)
else: → close-out

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host via the EDR. Remove any identified malicious DLLs or installer binaries after collection.
```
→ analyst-review

## analyst-review
<!-- Analyst review -->
```manual target=analyst
Review the process tree for the identified Foxit or Adobe events. Determine if the file created by the installer is a known DLL name (e.g. version.dll, dwmapi.dll) in an unexpected path.
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Record identified vulnerable hosts. If exploitation was not found, pass the vulnerable host list to the patching team.
```
→ end