Detections · CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

Public CTI triage - CVE-2026-47291

sigma · Pending service validation

title: Public CTI triage - CVE-2026-47291
id: 3ea2ba00-ba5f-5a53-9914-0274c44c06b8
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'CVE-2026-47291'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

SPL triage - CVE-2026-47291

spl · validation unavailable

index=* (CommandLine="*CVE-2026-47291*")

KQL triage - CVE-2026-47291

kql · validation unavailable

DeviceProcessEvents | where ProcessCommandLine contains "CVE-2026-47291"