Sigma rule: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

Rule

Title

LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-06-02

File

rules-emerging-threats/2026/Exploits/CVE-2026-41089/win_application_error_exploit_cve_2026_41089_lsass_netlogon_crash.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

Log source

product

windows

service

application

Detection

selection:
    Provider_Name: 'Application Error'
    EventID: 1000
    AppName: 'lsass.exe'
    ModuleName: 'netlogon.dll'
    ExceptionCode: 'c0000409' # STATUS_STACK_BUFFER_OVERRUN
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.impact
• attack.t1499
• cve.2026-41089
• detection.emerging-threats

CVEs this rule names

• CVE-2026-41089

MITRE ATT&CK ids this rule names

• T1499

References

• https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
• https://learn.microsoft.com/en-us/shows/inside/c0000409
• https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/CVE-2026-41089/win_application_error_exploit_cve_2026_41089_lsass_netlogon_crash.yml