A third Windows Shell MOTW bypass exploited in a year

Microsoft’s October 2026 Patch Tuesday included a fix for CVE-2026-96951, a Windows Shell security feature bypass (CWE-77, improper neutralization of special elements used in a command — i.e. command injection) carrying a CVSS score of 8.8. Microsoft confirmed active exploitation at disclosure, and CISA added it to the Known Exploited Vulnerabilities catalog shortly after. No authentication is required; the attacker only needs a victim to interact with a specially crafted file delivered by email, Teams, Slack, or a drive-by download.

The payoff for the attacker is that the file skips Mark of the Web (MOTW) entirely — no SmartScreen prompt, no Protected View, no “this file came from the internet” warning. Tenable researcher Satnam Narang noted this is the third Windows Shell flaw exploited in the wild in 2026 to achieve exactly this outcome, after CVE-2026-21510 (linked to APT28) and CVE-2026-32202, which patched an incomplete fix for the first one. That pattern — patch, bypass, patch again — means defenders should assume a fourth variant is plausible and build detection around the behavioral signature (a downloaded file executing without the zone-identifier trail it should have), not just the specific CVE.

Detection priorities

  1. Files that execute from Downloads/INetCache/Temp paths without a corresponding Zone.Identifier alternate data stream (ADS) having been written first
  2. Zone.Identifier ADS being deleted, truncated, or never created immediately after a file lands from a browser, mail client, or chat app
  3. Script-host or shell child processes (wscript, cscript, mshta, powershell, cmd) spawned by explorer.exe acting on a recently-created downloaded file
  4. Absence of SmartScreen/Defender SmartScreen block or warning events for files that should have triggered one given their origin URL

Sigma — script host executing a freshly downloaded file via Explorer

title: Script Interpreter Spawned by Explorer Executing Recently Downloaded File
id: c4f1a8e6-7d3b-4a92-8e5f-1b9c6d4e2a73
status: experimental
description: >
  Detects wscript, cscript, mshta, or powershell launched as a child of
  explorer.exe against a file path under Downloads, INetCache, or Temp —
  consistent with exploitation of CVE-2026-96951, a Windows Shell MOTW
  bypass that lets a crafted file execute without triggering SmartScreen
  or Protected View warnings normally applied to internet-sourced files.
references:
  - https://www.helpnetsecurity.com/2026/10/14/microsoft-fixes-exploited-mark-of-the-web-bypass-vulnerability-cve-2026-96951/
  - https://securityaffairs.com/200965/security/cisa-adds-microsoft-windows-shell-flaw-known-exploited-vulnerabilities-catalog.html
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\INetCache\'
      - '\AppData\Local\Temp\'
      - '\Content.Outlook\'
  condition: selection_parent and selection_child and selection_path
falsepositives:
  - Legitimate scripts intentionally run by users from Downloads (rare outside dev/IT workflows)
  - Software installers that stage helper scripts in Temp before execution
level: high
tags:
  - attack.defense_evasion
  - attack.t1553.005
  - attack.initial_access
  - attack.t1204.002

Sigma — Zone.Identifier alternate data stream deleted immediately after file creation

title: Zone Identifier ADS Removed Shortly After File Creation
id: e2b7d4f9-3a6c-4e1d-9f82-5c7a1e9b4d06
status: experimental
description: >
  Detects deletion or truncation of a Zone.Identifier alternate data stream
  within seconds of the parent file being created — the generic pattern
  behind Mark of the Web stripping techniques, including CVE-2026-96951
  style Windows Shell bypasses where the ADS is never populated or is
  removed before the file is opened.
references:
  - https://securityaffairs.com/200965/security/cisa-adds-microsoft-windows-shell-flaw-known-exploited-vulnerabilities-catalog.html
logsource:
  category: file_event
  product: windows
  service: sysmon
detection:
  selection_create:
    EventID: 15
    TargetFilename|contains: ':Zone.Identifier'
  selection_delete:
    EventID:
      - 23
      - 26
    TargetFilename|contains: ':Zone.Identifier'
  timeframe: 30s
  condition: selection_create and selection_delete
falsepositives:
  - Archive utilities that intentionally strip zone data after user-approved extraction
  - Some backup/sync tools that rewrite ADS metadata
level: medium
tags:
  - attack.defense_evasion
  - attack.t1553.005

KQL — Microsoft Defender/Sentinel: execution without expected SmartScreen signal

// Files created from an internet-origin download, executed within 5 minutes,
// with no corresponding SmartScreen warning/block event in between.
let downloaded_files =
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where isnotempty(FileOriginUrl) or isnotempty(FileOriginReferrerUrl)
    | where FolderPath has_any (@"\Downloads\", @"\INetCache\", @"\AppData\Local\Temp\")
    | project FileCreateTime = Timestamp, DeviceId, FileName, FolderPath, SHA256, FileOriginUrl;
let smartscreen_events =
    DeviceEvents
    | where Timestamp > ago(7d)
    | where ActionType has_any ("SmartScreenUrlWarning", "SmartScreenAppWarning", "AntivirusDetection")
    | project DeviceId, SmartScreenTime = Timestamp, ActionType;
downloaded_files
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | project ExecTime = Timestamp, DeviceId, FileName, ProcessCommandLine, InitiatingProcessFileName
  ) on DeviceId, FileName
| where ExecTime between (FileCreateTime .. FileCreateTime + 5m)
| join kind=leftouter smartscreen_events on DeviceId
| where isnull(SmartScreenTime) or SmartScreenTime > ExecTime
| project FileCreateTime, ExecTime, DeviceId, FileName, FolderPath, FileOriginUrl, ProcessCommandLine, InitiatingProcessFileName
| sort by ExecTime desc

Remediation and response

Apply the October 2026 cumulative update that fixes CVE-2026-96951 as the primary control — this is a shell-level bypass, not something endpoint rules alone can fully close. Until patched, tighten SmartScreen and Attachment Manager policy via GPO/Intune to app-enforce MOTW handling rather than relying on default Explorer behavior, and treat wscript/mshta/powershell execution sourced from explorer.exe against Downloads or Temp paths as a high-priority alert regardless of file extension, since the whole point of this bypass class is that the usual “double extension” or “unsigned script” heuristics don’t fire. Given the APT28-linked predecessor (CVE-2026-21510) and its incomplete-patch follow-up (CVE-2026-32202), hunt retroactively for the same process-chain pattern going back to each of those disclosure dates, not just October 2026.

Sources: Help Net Security — Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951), Security Affairs — CISA adds Microsoft Windows Shell flaw to its KEV catalog