CVE-2026-41089: MITRE ATT&CK Mapping, SIEM Queries, and Domain Controller Hardening

MITRE ATT&CK Mapping

CVE-2026-41089 maps across multiple ATT&CK tactics depending on how far the attacker progresses. The DoS path covers three tactics reliably. Full RCE, if achieved, extends through seven. Each technique below is directly tied to an observable stage in the attack chain.

ATT&CK Navigator Coverage — DoS Path vs. Full RCE Path

Log Sources: What You Need Enabled

Detection coverage across this attack chain requires log sources that are not enabled by default on Windows Server. Verify these are active on every domain controller before relying on any of the SIEM queries below.

SIEM Queries: Full Coverage Across Platforms

Splunk

# ── QUERY 1: LSASS crash from netlogon.DLL overflow ──────────────────────
index=wineventlog source="WinEventLog:Application"
  EventID=1000
  Process_Name="lsass.exe"
  Module_Name="netlogon.DLL"
  Exception_Code="0xc0000409"
| eval risk="CRITICAL - CVE-2026-41089 candidate"
| table _time, host, Process_Name, Module_Name, Exception_Code, risk

# ── QUERY 2: Unexpected DC reboot (no prior maintenance window event) ────
index=wineventlog source="WinEventLog:System"
  (EventID=1074 OR EventID=6008)
| eval reboot_type=if(EventID=6008,"Unexpected shutdown","Admin/patch reboot")
| table _time, host, EventID, reboot_type, Message

# ── QUERY 3: LSASS child process (post-RCE signal) ───────────────────────
index=sysmon EventCode=1
  ParentImage="*\\lsass.exe"
| eval risk="CRITICAL - Abnormal LSASS child process"
| table _time, host, Image, ParentImage, CommandLine, User, risk

# ── QUERY 4: Outbound network from LSASS (post-RCE signal) ──────────────
index=sysmon EventCode=3
  Image="*\\lsass.exe"
  NOT dest_ip IN ("127.0.0.1","::1")
| eval risk="CRITICAL - LSASS outbound connection"
| table _time, host, Image, dest_ip, dest_port, risk

# ── QUERY 5: DCSync — DS-Replication-Get-Changes-All abuse ──────────────
index=wineventlog source="WinEventLog:Security"
  EventID=4662
  Object_Type="*domainDNS*"
  Access_Mask="0x100"
  NOT SubjectUserName IN ("*$","MSOL_*","AADConnect*")
| eval risk="HIGH - Possible DCSync / credential harvest"
| table _time, host, SubjectUserName, Object_Name, Access_Mask, risk

# ── QUERY 6: Privileged group change outside business hours ──────────────
index=wineventlog source="WinEventLog:Security"
  EventID IN (4728, 4732, 4756)
| eval hour=strftime(_time,"%H")
| where hour < 8 OR hour > 18
| eval risk="HIGH - Off-hours privileged group modification"
| table _time, host, SubjectUserName, MemberName, GroupName, risk

# ── QUERY 7: Domain-wide 60s auth failure spike (DoS pattern) ───────────
index=wineventlog source="WinEventLog:Security"
  EventID IN (4771, 4776)
| timechart span=10s count AS auth_failures by host
| where auth_failures > 50

Elastic / KQL

# ── LSASS crash with netlogon faulting module ─────────────────────────────
event.code:1000 AND
process.name:lsass.exe AND
winlog.event_data.ModuleName:*netlogon* AND
winlog.event_data.ExceptionCode:0xc0000409

# ── LSASS child process spawned ──────────────────────────────────────────
event.code:1 AND
process.parent.name:lsass.exe AND NOT
process.name:(csrss.exe OR wininit.exe OR services.exe)

# ── Outbound connection from LSASS ───────────────────────────────────────
event.code:3 AND
process.name:lsass.exe AND NOT
destination.ip:(127.0.0.1 OR "::1" OR "0:0:0:0:0:0:0:1")

# ── DCSync replication rights access ─────────────────────────────────────
event.code:4662 AND
winlog.event_data.ObjectType:*domainDNS* AND
winlog.event_data.AccessMask:0x100 AND NOT
winlog.event_data.SubjectUserName:(*$ OR MSOL_*)

# ── Unexpected DC reboot ──────────────────────────────────────────────────
event.code:(1074 OR 6008) AND
winlog.channel:System

Microsoft Sentinel (KQL)

// ── LSASS crash with netlogon.DLL faulting module ────────────────────────
SecurityEvent
| where EventID == 1000
| where CommandLine has "lsass.exe"
    and CommandLine has "netlogon.DLL"
    and CommandLine has "0xc0000409"
| project TimeGenerated, Computer, CommandLine
| extend Risk = "CRITICAL - CVE-2026-41089 candidate"

// ── DCSync: DS-Replication-Get-Changes-All from non-DC account ───────────
SecurityEvent
| where EventID == 4662
| where ObjectType contains "domainDNS"
| where AccessMask == "0x100"
| where SubjectUserName !endswith "$"
| where SubjectUserName !startswith "MSOL_"
| project TimeGenerated, Computer, SubjectUserName, ObjectName
| extend Risk = "HIGH - DCSync / krbtgt harvest candidate"

// ── Off-hours privileged group modification ───────────────────────────────
SecurityEvent
| where EventID in (4728, 4732, 4756)
| where hourofday(TimeGenerated) !between (8 .. 18)
| project TimeGenerated, Computer, SubjectUserName, MemberName, TargetUserName
| extend Risk = "HIGH - Off-hours privileged group change"

// ── Auth failure spike (60s window DoS detection) ────────────────────────
SecurityEvent
| where EventID in (4771, 4776)
| summarize FailureCount = count() by bin(TimeGenerated, 10s), Computer
| where FailureCount > 50
| extend Risk = "MEDIUM - Possible DC authentication outage"

// ── Kerberos ticket anomaly: TGS without preceding TGT on same host ──────
let tgt_requests = SecurityEvent
    | where EventID == 4768
    | project TGT_Time=TimeGenerated, TGT_Host=Computer, TGT_User=TargetUserName;
let tgs_requests = SecurityEvent
    | where EventID == 4769
    | project TGS_Time=TimeGenerated, TGS_Host=Computer, TGS_User=TargetUserName;
tgs_requests
| join kind=leftanti tgt_requests
    on $left.TGS_User == $right.TGT_User
| where TGS_Time > ago(1h)
| extend Risk = "HIGH - TGS without TGT - possible Golden Ticket use"

Domain Controller Hardening: Prioritized Checklist

The following controls address CVE-2026-41089 directly and harden DCs against the full class of pre-authentication Netlogon attacks — not just this CVE. Controls are organized by implementation priority.

Chaining Risk: Two-Stage Attack Model

Full RCE from CVE-2026-41089 alone remains difficult. In practice, the more dangerous scenario is a chained attack where the DoS capability serves as an operational tool enabling a separate compromise vector.

SecPod Coverage

This concludes the CVE-2026-41089 four-part research series. The patch is available. Exploitation is confirmed and ongoing. Every domain controller running a vulnerable build with UDP 389 reachable is one packet away from a domain-wide authentication outage — from anyone, with no credentials, no prior access, and no warning.

Parts 1–3 cover the vulnerability mechanics, PoC analysis, and patch/IOC/detection guidance respectively.