Windows IKE — CVE-2026-33824

What this hunt looks for: Systems exposed to IKE/IPsec traffic and suspicious process execution following UDP 500/4500 activity, including unusual child processes of svchost.exe on Windows VPN/RRAS servers.
Required logs: Microsoft Defender for Endpoint DeviceNetworkEvents and DeviceProcessEvents.

Hunt 1 — Identify Systems Receiving IKE Traffic

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where Protocol =~ "Udp"
| where LocalPort in (500, 4500)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=dcount(RemoteIP), SampleRemoteIPs=make_set(RemoteIP, 20) by DeviceName, DeviceId, LocalIP, LocalPort
| sort by Connections desc

Hunt 2 — Suspicious Process Execution After IKE Traffic

let IKEConnections = DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where Protocol =~ "Udp" and LocalPort in (500, 4500)
| project DeviceId, IKETime=TimeGenerated, RemoteIP, LocalIP, LocalPort;
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessFileName =~ "svchost.exe"
| project DeviceId, DeviceName, ProcessTime=TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| join kind=inner IKEConnections on DeviceId
| where ProcessTime between (IKETime .. IKETime + 10m)
| project ProcessTime, DeviceName, RemoteIP, LocalIP, LocalPort, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by ProcessTime asc

Hunt 3 — Rare Child Processes of svchost.exe on VPN Servers

Replace the sample values with known Windows RRAS / VPN systems.

let VPNServers = dynamic(["VPN-SERVER-01", "VPN-SERVER-02"]);
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where DeviceName in~ (VPNServers)
| where InitiatingProcessFileName =~ "svchost.exe"
| summarize Executions=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName, 20) by FileName, ProcessCommandLine
| sort by Executions asc