--- analysis: A simple detection rule flags a single CVE hit. This hunt pivots between vulnerability findings and a host-behavioural baseline, asking whether exposed hosts exhibit the specific child-shell patterns and rare process deployments that follow successful exploitation of these flaws. blind_spots: - id: incomplete-vuln-telemetry question: Which unmanaged systems remain vulnerable but are not reporting to hb_vulnerability_finding? requires: Complete coverage of vulnerability scanning agents risk: Unmanaged systems could serve as a beachhead without being scoped by the initial query. stage: initial-access-remote-services - id: short-lived-processes question: Did an exploit process run and exit between snapshot intervals? requires: Continuous process event logs (Sysmon) rather than snapshots risk: Short-lived elevation of privilege payloads might be missed if they complete their task before the next process inventory collection. stage: privilege-escalation-zero-day coverage: - stage: initial-access-remote-services status: covered steps: - vuln-finding-scoping - service-child-behaviour - stage: execution-malicious-media-and-office status: covered steps: - vuln-finding-scoping - service-child-behaviour - stage: privilege-escalation-zero-day status: covered steps: - vuln-finding-scoping - rare-process-baseline - reason: Azure Cosmos DB and Spring Cloud Azure exploitation require cloud control-plane telemetry not listed as a source. stage: initial-access-cloud-and-database status: not_visible guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: The September 2026 Patch Tuesday involves nearly 1,000 vulnerabilities, including two zero-day elevation of privilege flaws. Verifying that these have not been exploited before the patch cycle completes is critical for ensuring environmental integrity. methodology: model-assisted trigger: intel-report hypothesis: An adversary is exploiting September 2026 zero-day or critical remote code execution vulnerabilities, such as those in DNS Server or the Windows Update Stack, to establish initial access or escalate privileges on unpatched systems. labels: - hunt - attack.t1190 - attack.t1572 - attack.t1068 - attack.t1203 name: Microsoft Patch Tuesday September 2026 Exposure parameters: lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hostnames to focus the hunt on; if empty, examines the full estate. type: list[host] shell_interpreters: default: - cmd.exe - powershell.exe - pwsh.exe - scrcons.exe - wscript.exe - cscript.exe description: Common shell and script interpreters used in post-exploitation. from: kind: manual observed: '2026-09-08' ref: Common post-exploitation tools type: list[string] target_cves: default: - CVE-2026-81963 - CVE-2026-85880 - CVE-2026-69730 - CVE-2026-67631 - CVE-2026-69852 - CVE-2026-72957 description: Critical and exploited-in-the-wild CVEs from the September advisory. from: kind: article observed: '2026-09-08' ref: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ type: list[string] vulnerable_parents: default: - dns.exe - sqlservr.exe - winword.exe - excel.exe - outlook.exe - skype.exe - wmplayer.exe description: Processes associated with the September vulnerabilities that might spawn child shells. from: kind: manual observed: '2026-09-08' ref: September 2026 Vulnerability List type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt starts with wide coverage using hb_vulnerability_finding for critical CVEs. It prioritizes Domain Controllers (DNS), SQL Servers, and workstations with unpatched Office applications. The results populate a list of hosts for more expensive behavioural analysis. references: - name: "Talos \u2014 Microsoft Patch Tuesday for September 2026" url: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/ related: - hunt: azure-cosmos-db-spoofing-bypass reason: Exploitation of Azure Cosmos DB (CVE-2026-69857) requires Azure-native activity logs, which were not in scope for this endpoint-focused hunt. relation: out-of-scope-alternative scenario: stages: - name: Exploitation of Remote Network Services observables: - DNS Server (port 53) - Routing and Remote Access Service (RRAS) - Secure Socket Tunneling Protocol (SSTP) (port 443) - Windows Kerberos (port 88) - DHCP Server (ports 67, 68) - Reliable Multicast Transport Driver (RMCAST) - CVE-2026-69730 - CVE-2026-69676 - CVE-2026-73009 - CVE-2026-69852 slug: initial-access-remote-services tactic: initial-access techniques: - T1190 - T1572 - name: Client-Side Exploitation via Office and Media observables: - excel.exe - winword.exe - outlook.exe - skype.exe - wmplayer.exe - Microsoft Excel (CVE-2026-81948) - Microsoft Word (CVE-2026-81952) - Microsoft Office Outlook (CVE-2026-78525) - Windows Media Player (CVE-2026-70203) slug: execution-malicious-media-and-office tactic: execution techniques: - T1203 - name: Local Privilege Escalation and Zero-Day Exploitation observables: - Windows Update Stack (CVE-2026-81963) - Advanced Local Procedure Call (ALPC) (CVE-2026-85880) - Windows Hello (CVE-2026-81354) - Secure Kernel Mode (CVE-2026-69501) - Windows Virtualization-Based Security (VBS) (CVE-2026-83501) slug: privilege-escalation-zero-day tactic: privilege-escalation techniques: - T1068 - name: Cloud Infrastructure and Database Bypass observables: - Azure Cosmos DB (CVE-2026-69857) - Spring Cloud Azure (CVE-2026-69854) - Microsoft SQL Server (CVE-2026-67631) - Microsoft Dynamics 365 On-Premises (CVE-2026-65772) slug: initial-access-cloud-and-database tactic: initial-access techniques: - T1190 summary: The September 2026 Microsoft Patch Tuesday includes nearly 1,000 vulnerabilities, featuring zero-day privilege escalation flaws in the Windows Update Stack and ALPC alongside critical remote code execution risks in DNS, Kerberos, and RRAS. These vulnerabilities provide multiple paths for attackers to gain initial access via remote services or malicious media before escalating to system-level privileges. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Microsoft Patch Tuesday September 2026 Exposure This hunt identifies exposure and potential exploitation following the September 2026 Microsoft Patch Tuesday. It focuses on the zero-day elevation of privilege in the Windows Update Stack (CVE-2026-81963) and critical remote code execution flaws in infrastructure services like DNS (CVE-2026-69730) and SQL Server (CVE-2026-67631). The hunt scopes the estate using vulnerability telemetry, establishes a process baseline to identify rare binaries on exposed hosts, and hunts for behavioural indicators like shell execution from high-privilege service parents. ## vuln-finding-scoping Identify which hosts have been flagged with the high-priority CVEs from the September 2026 advisory. ```sqlite target=endpoint role=scoping params=(target_cves=target_cves) ~~~yaml expected: A list of vulnerable devices. Silence indicates no scanned assets currently match the high-priority CVE list. reads: - device_uid - cve_uid - affected_package_name - affected_package_version - severity silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 ``` ## rare-process-baseline Identify unusual process executions on hosts currently known to be vulnerable, which may indicate payload delivery. ```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of processes seen on only one or two hosts. Silence suggests a consistent software baseline across unpatched systems. prevalence: by: device_hostname key: - process_path rare_below: 3 reads: - process_path - process_cmd_line - device_hostname - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT process_path, process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_path, process_cmd_line HAVING host_count <= 2 ORDER BY host_count ASC ``` ## service-child-behaviour Find behavioural evidence of RCE or EoP where high-privilege service processes or Office apps spawn interpreters. ```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days, vulnerable_parents=vulnerable_parents, shell_interpreters=shell_interpreters) ~~~yaml expected: Rows showing a shell spawned from a vulnerable parent process like dns.exe or outlook.exe. This is high-confidence evidence of exploitation. reads: - device_hostname - parent_process_name - process_name - process_cmd_line - user_name - integrity_level - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, integrity_level, time FROM hb_process_activity WHERE (instr(',' || '{{vulnerable_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR (LOWER(parent_process_name) = 'svchost.exe' AND LOWER(parent_process_cmd_line) LIKE '%rras%')) AND instr(',' || '{{shell_interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## exposure-triage ```agent target=hunter cite: required context: - vuln-finding-scoping - rare-process-baseline - service-child-behaviour max_iterations: 3 objective: Determine if any host flagged with critical September 2026 vulnerabilities exhibits suspicious process activity, citing rows from the baseline and behaviour queries. success_criteria: A per-host verdict of exposed-benign | exposed-suspicious | potentially-exploited. tools: - endpoint ``` ## exploitation-decision if~: "the triage verdict identifies potentially-exploited or exposed-suspicious activity on at least one host" (confidence: high, judge=hunter) then: → remediation-task indeterminate: → remediation-task unavailable: → remediation-task (blind_spot: incomplete-vuln-telemetry) else: → close-out-task ## remediation-task ```manual target=analyst Review the agent's findings for the identified hosts. Confirm with the vulnerability management team whether the September 2026 patches have been applied. If the rare process activity or child-shell findings are verified as malicious, escalate to the incident response team and follow the standard isolation playbook. Document any findings that represent authorized administrative tools to tune future runs. ``` → close-out-task ## close-out-task ```manual target=analyst Summarize the total count of vulnerable hosts versus those showing suspicious behaviour. Record any gaps in vulnerability scanning coverage identified during the hunt. Submit a final report to the patch management team to verify the closure of critical exposure windows. ``` → end