LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

Status: experimental
Severity: high
Log source: product windows, service application
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1499` Endpoint Denial of Service

Telemetry coverage

Provider	Record / event type
Application-Error	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.

Rule body

title: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089
id: f8a66a02-4a16-46e5-b7fd-a42c8a93d137
status: experimental
description: |
    Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
    This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
    which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
    leading to a stack-based buffer overflow and subsequent crash of the LSASS process.
references:
    - https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
    - https://learn.microsoft.com/en-us/shows/inside/c0000409
    - https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-06-02
tags:
    - attack.impact
    - attack.t1499
    - cve.2026-41089
    - detection.emerging-threats
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'Application Error'
        EventID: 1000
        AppName: 'lsass.exe'
        ModuleName: 'netlogon.dll'
        ExceptionCode: 'c0000409' # STATUS_STACK_BUFFER_OVERRUN
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Provider_Name: 'Application Error'
    EventID: 1000
    AppName: 'lsass.exe'
    ModuleName: 'netlogon.dll'
    ExceptionCode: 'c0000409'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AppName`	eq	`lsass.exe` corpus 2 (sigma 2)	`field:"AppName" kind:eq value:"lsass.exe"`
`ExceptionCode`	eq	`c0000409`	`field:"ExceptionCode" kind:eq value:"c0000409"`
`ModuleName`	eq	`netlogon.dll`	`field:"ModuleName" kind:eq value:"netlogon.dll"`
`Provider_Name`	eq	`Application Error` corpus 5 (sigma 5)	`field:"Provider_Name" kind:eq value:"Application Error"`