Hunt
Analysis of CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
Hunt Strategy & Objective
Detect exploitation attempts targeting Windows HTTP.sys stack across IIS and web services.
⏱️ Lookback: 30 days
Hunt Hypothesis
Threat actors may have deployed activity documented in CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys.
Target Platforms & Environment
Windows
Linux
Network Security
Enterprise endpoints, cloud identities, and network telemetry.
Required Telemetry & Data Sources
Process creation
DNS logs
Authentication logs
Network flows
Procedural Hunting Sequence
- 1 Review IIS W3C access logs for HTTP 416 (Requested Range Not Satisfiable) errors with extremely large Range byte values.
- 2 Look for Windows Kernel BugCheck (BSOD) Event ID 1001 with Stop Code 0x0000007E or HTTP.sys in call stack.
- 3 Inspect network traffic for requests containing crafted Range: bytes=18446744073709551615 headers.
- 4 Audit exposed web servers for patch compliance.
Hunt Queries
Query Pattern 1
index=iis sc_status=416 cs_method=GET | table _time, s_ip, c_ip, cs_uri_stem, cs_User_Agent
Query Pattern 2
W3CIISLog | where scStatus == 416 and csMethod == 'GET' | project Timestamp, cIP, csUriStem, scStatus
✓
True Positive Confirmation Evidence
●
Anomalous binary execution
●
Unexpected child processes
●
C2 beaconing
!
Benign & False Positive Explanations
●
Scheduled backup scripts and authorized administrative utilities
Validation Checklist
Correlate timestamps with system activity
Confirm source authenticity
Escalation Criteria
Confirmed unapproved execution with suspicious outbound connections