Microsoft SharePoint — CVE-2026-55040

What this hunt looks for: Suspicious access to SharePoint authentication-sensitive API endpoints, unexpected child processes spawned by IIS worker processes, and outbound network activity that may indicate exploitation of CVE-2026-55040.
Required logs: SharePoint IIS web logs in W3CIISLog plus Microsoft Defender for Endpoint DeviceProcessEvents and DeviceNetworkEvents.

Hunt 1 — First-Pass SharePoint API Activity

W3CIISLog
| where TimeGenerated >= ago(30d)
| where csUriStem in~ ("/_api/web/currentuser", "/_api/contextinfo")
| where csUserAgent contains "curl"
| project TimeGenerated, Computer, cIP, csMethod, csUriStem, csUriQuery, csUserName, csUserAgent, scStatus
| sort by TimeGenerated asc

Hunt 2 — Broader Suspicious Access to Authentication-Sensitive APIs

W3CIISLog
| where TimeGenerated >= ago(30d)
| where csUriStem has_any ("/_api/web/currentuser", "/_api/contextinfo")
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), StatusCodes=make_set(scStatus, 20), UserAgents=make_set(csUserAgent, 20), Users=make_set(csUserName, 20) by Computer, cIP, csMethod, csUriStem
| sort by Requests desc

Hunt 3 — SharePoint Worker Process Spawning Suspicious Children

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "cscript.exe", "wscript.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 4 — Outbound Network Activity From SharePoint Worker Processes

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, Protocol
| sort by TimeGenerated asc