Detections · CVE-2026-33824: Remote Code Execution in Windows IKEv2

Public CTI triage - CVE-2026-33824

sigma · Pending service validation

title: Public CTI triage - CVE-2026-33824
id: 4e8d2a4b-29b8-5a45-b9d4-bf5e72ff40d3
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'CVE-2026-33824'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

SPL triage - CVE-2026-33824

spl · validation unavailable

index=* (CommandLine="*CVE-2026-33824*")

KQL triage - CVE-2026-33824

kql · validation unavailable

DeviceProcessEvents | where ProcessCommandLine contains "CVE-2026-33824"