---
analysis: A single detection rule might alert on a known shell spawn from spoolsv.exe,
  but this hunt connects unpatched vulnerability state to stability signals (crashes)
  and then to execution, providing the full context required to distinguish an exploit
  from general system instability.
blind_spots:
- id: telemetry-gaps
  question: whether unmanaged hosts are vulnerable and exploited
  requires: Complete endpoint agent coverage
  risk: A host without an agent provides no crash or process telemetry, making it
    a blind spot for behavioral analysis.
- id: msmq-rpc-visibility
  question: whether exploitation is occurring via specific MSMQ RPC calls
  requires: hb_network_connection with rpc_interface_uuid
  risk: General socket monitoring on Port 1801 shows connectivity but not the specific
    MSMQ operations that would indicate a heap overflow exploit.
  stage: remote-service-exploitation
coverage:
- stage: client-side-exploitation
  status: covered
  steps:
  - crash-prevalence
- stage: remote-service-exploitation
  status: covered
  steps:
  - anomalous-child-processes
  - crash-prevalence
- stage: local-privilege-escalation
  status: covered
  steps:
  - service-instability
- stage: identity-infrastructure-compromise
  status: covered
  steps:
  - suspicious-logons
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: The November 2026 update addresses over 1,300 vulnerabilities, including
    multiple high-severity RCEs and EoPs. Verifying the absence of behavioral exploitation
    signs is critical for prioritizing remediation.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is exploiting unpatched November 2026 vulnerabilities to
  gain access or elevate privileges, causing service crashes followed by anomalous
  child processes or suspicious RDP logins.
labels:
- hunt
- attack.t1190
- attack.t1566
- attack.t1068
- attack.t1021.001
- execution
- initial access
- lateral movement
- privilege escalation
name: Endpoint Exploit and Service Crash Monitoring
parameters:
  critical_apps:
    default:
    - outlook.exe
    - winword.exe
    - excel.exe
    - mqsvc.exe
    - spoolsv.exe
    - msiexec.exe
    description: Process names vulnerable to RCE or privilege escalation.
    type: list[path]
  lookback_days:
    default: '14'
    description: Days of history to examine for behavior.
    type: number
  post_exploit_binaries:
    default:
    - cmd.exe
    - powershell.exe
    - bitsadmin.exe
    - certutil.exe
    - schtasks.exe
    description: Common shell and LOLBin executables used after exploitation.
    type: list[path]
  scope_hosts:
    default: []
    description: Optional host filter; leave empty for whole fleet.
    type: list[host]
  vulnerable_cves:
    default:
    - CVE-2026-109459
    - CVE-2026-124194
    - CVE-2026-118146
    - CVE-2026-113752
    - CVE-2026-105501
    - CVE-2026-116714
    description: CVE identifiers from the November 2026 update.
    from:
      kind: article
      observed: '2026-11-11'
      ref: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: The hunt starts with systems reporting the specific November 2026 CVEs
  in hb_vulnerability_finding. Prioritize servers running MSMQ (Port 1801) or hosting
  critical Office workloads.
references:
- name: "Microsoft Patch Tuesday for November 2026 \u2014 Snort rules and prominent\
    \ vulnerabilities"
  url: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/
related:
- hunt: azure-grafana-ssrf-monitoring
  reason: Azure Managed Grafana exploitation (CVE-2026-114160) requires cloud API
    activity monitoring, which is out of scope for this endpoint-focused behavioral
    hunt.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Client-Side Initial Access
    observables:
    - outlook.exe
    - winword.exe
    - excel.exe
    - CVE-2026-124194
    - CVE-2026-110043
    - CVE-2026-110047
    - CVE-2026-118292
    slug: client-side-exploitation
    tactic: initial-access
    techniques:
    - T1190
    - T1566
  - name: Exploitation of Remote Services
    observables:
    - mqsvc.exe
    - spoolsv.exe
    - srvnet.sys
    - Port 1801
    - Port 445
    - CVE-2026-109459
    - CVE-2026-113825
    - CVE-2026-118207
    slug: remote-service-exploitation
    tactic: execution
    techniques:
    - T1190
    - T1210
  - name: Local Privilege Escalation
    observables:
    - msiexec.exe
    - spoolsv.exe
    - AppXDeploymentServer
    - CVE-2026-105501
    - CVE-2026-113752
    - CVE-2026-116714
    slug: local-privilege-escalation
    tactic: privilege-escalation
    techniques:
    - T1068
  - name: Identity and Infrastructure Compromise
    observables:
    - Active Directory Domain Services
    - Azure Managed Grafana
    - CVE-2026-118146
    - CVE-2026-118148
    - CVE-2026-114160
    slug: identity-infrastructure-compromise
    tactic: lateral-movement
    techniques:
    - T1021.001
  summary: The November 2026 Microsoft security update addresses over 1300 vulnerabilities,
    including critical remote code execution (RCE) flaws in Office, Exchange, and
    core Windows services like MSMQ and SMB. A spoofing vulnerability in Outlook is
    being exploited in the wild, while critical authorization bypasses in Active Directory
    and Azure Managed Grafana pose significant infrastructure risks.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
tlp: clear
type: investigation
---


# Endpoint Exploit and Service Crash Monitoring

This hunt targets critical vulnerabilities disclosed in the November 2026 Patch Tuesday update. It monitors for evidence of exploitation in two primary phases: early signals of instability (application crashes and service state changes) and follow-on malicious activity (unauthorized shell execution and lateral movement). The hunt uses a phased flow to connect the presence of unpatched software with behavioral indicators of compromise, allowing an agent to weigh the full attack chain.

## vulnerable-inventory
<!-- Identify unpatched hosts -->
Scope the hunt to hosts reporting the targeted November 2026 CVEs.

```sqlite target=endpoint role=scoping params=(vulnerable_cves=vulnerable_cves)
~~~yaml
expected: A list of vulnerable devices. Absence does not mean they are safe, only
  that they have been scanned and reported.
reads:
- cve_uid
- device_uid
- first_seen
- severity
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-11-11'
~~~
SELECT device_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0
```

## early-signals
<!-- Monitor early stage signals -->
parallel:
- → crash-prevalence
- → service-instability
join: → early-triage

## crash-prevalence
<!-- Rare application crashes -->
Find rare crashes in vulnerable applications that may indicate memory-corruption exploit attempts.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, critical_apps=critical_apps, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Rare crashes (low host count) for vulnerable services like mqsvc.exe or
  spoolsv.exe.
prevalence:
  by: device_hostname
  key:
  - app_name
  rare_below: 5
reads:
- app_name
- device_hostname
- exception_code
- time
silence: not_evidence_of_absence
source: hb_application_error
verified: dry-run
verified_at: '2026-11-11'
~~~
SELECT app_name, device_hostname, exception_code, COUNT(*) AS crash_count, MIN(time) AS first_crash FROM hb_application_error WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(app_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY app_name, device_hostname
```

## service-instability
<!-- Service state changes -->
Monitor for unexpected stops or crashes in critical Windows services targeted by privilege escalation CVEs.

```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, critical_apps=critical_apps, scope_hosts=scope_hosts)
~~~yaml
expected: Service stops occurring near crash events or suspicious software installation
  logs.
reads:
- device_hostname
- service_name
- service_state
- time
silence: not_evidence_of_absence
source: hb_service_activity
verified: dry-run
verified_at: '2026-11-11'
~~~
SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(service_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## early-triage
<!-- Early stage read -->
```agent target=hunter
cite: required
context:
- vulnerable-inventory
- crash-prevalence
- service-instability
max_iterations: 4
objective: Determine if the crashes and service instability on vulnerable hosts align
  with the exploitation of November 2026 vulnerabilities.
success_criteria: A per-host verdict of instability vs. exploitation attempt.
tools:
- endpoint
- identity
```

## follow-on-signals
<!-- Monitor follow-on activity -->
parallel:
- → anomalous-child-processes
- → suspicious-logons
join: → full-chain-analysis

## anomalous-child-processes
<!-- Anomalous child processes -->
Detect shells or LOLBins launched by vulnerable services, indicative of successful code execution.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, critical_apps=critical_apps, post_exploit_binaries=post_exploit_binaries, scope_hosts=scope_hosts)
~~~yaml
expected: System services or Office apps spawning shells. This is high-confidence
  evidence of exploitation.
reads:
- device_hostname
- parent_process_name
- process_cmd_line
- process_name
- time
- user_name
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-11-11'
~~~
SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{post_exploit_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## suspicious-logons
<!-- Suspicious RDP sign-ins -->
Identify lateral movement originating from or targeting likely beachheads.

```sqlite target=identity role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: New or unexpected sign-ins involving hosts that previously showed exploitation
  signals.
reads:
- actor_user_name
- device_hostname
- dst_endpoint_hostname
- logon_type
- src_endpoint_ip
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-11-11'
~~~
SELECT device_hostname, dst_endpoint_hostname, actor_user_name, logon_type, src_endpoint_ip, time FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') AND logon_type IN ('Remote Interactive', 'Network') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0 OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0)
```

## full-chain-analysis
<!-- Follow-on stage read -->
```agent target=hunter
cite: required
context:
- early-triage
- anomalous-child-processes
- suspicious-logons
max_iterations: 6
objective: Evaluate the combined evidence of unpatched vulnerabilities, service crashes,
  anomalous processes, and sign-in activity to confirm successful exploitation.
success_criteria: A final verdict of malicious | suspicious for any host with confirmed
  follow-on activity.
tools:
- endpoint
- identity
```

## route
<!-- Route on verdict -->
if~: "the full-chain-analysis verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → contain-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: telemetry-gaps)
else: → patch-verification

## contain-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host via the EDR and capture a memory dump for forensic analysis.
```
→ analyst-review

## analyst-review
<!-- Analyst triage and close-out -->
```manual target=analyst
Review the full-chain analysis; confirm if the service crashes were related to the unpatched CVEs and subsequent behavior.
```
→ patch-verification

## patch-verification
<!-- Patching verification -->
```manual target=analyst
Confirm that the November 2026 security updates are applied to all systems listed in the initial scoping query.
```
→ end