Hunt Strategy & Objective
Hunt for unexpected crashes in the IKE and AuthIP IPsec Keying Modules service (IKEEXT) and high-volume UDP port 500/4500 traffic.
⏱️ Lookback: 30 days
Hunt Hypothesis
Threat actors may have deployed activity documented in CVE-2026-33824: Remote Code Execution in Windows IKEv2.
Target Platforms & Environment
Windows
Linux
Network Security
Enterprise endpoints, cloud identities, and network telemetry.
Required Telemetry & Data Sources
Process creation
DNS logs
Authentication logs
Network flows
Procedural Hunting Sequence
- 1 Check Application Event Log (Event ID 1000) for crashes where Faulting module is ikeext.dll.
- 2 Monitor network perimeter logs for oversized or fragmented UDP packets directed at ports 500 and 4500.
- 3 Inspect system memory for heap manipulation in svchost.exe instances hosting IKEEXT.
- 4 Verify patch installation status for Microsoft Security Bulletin addressing CVE-2026-33824.
Hunt Queries
Query Pattern 1
index=windows EventCode=1000 (FaultingModuleName=ikeext.dll OR ApplicationName=*svchost.exe*) | table _time, Computer, ExceptionCode, FaultingModuleName
Query Pattern 2
DeviceEvents | where ActionType == 'AppCrash' and AdditionalFields has 'ikeext.dll' | project Timestamp, DeviceName, FileName, AdditionalFields
✓
True Positive Confirmation Evidence
●
Anomalous binary execution
●
Unexpected child processes
●
C2 beaconing
!
Benign & False Positive Explanations
●
Scheduled backup scripts and authorized administrative utilities
Validation Checklist
Correlate timestamps with system activity
Confirm source authenticity
Escalation Criteria
Confirmed unapproved execution with suspicious outbound connections