Potential Net-NTLM Coercion via Snipping Tool ms-screensketch URI (CVE-2026-33829)

[rule]
description = """
Identifies Snipping Tool started with an ms-screensketch deep link whose filePath parameter points at a remote resource
(URL-encoded UNC, literal UNC, or http-based value), consistent with public research on CVE-2026-33829. Affected builds
can coerce an authenticated SMB connection and leak Net-NTLM responses for the current user when the handler processes
an attacker-controlled filePath. Apply the vendor security update from the April 14, 2026 release train when available.
"""
id = "b2c4d6e8-0a1f-4b3c-8d9e-1f2a3b4c5d6e"
license = "Elastic License v2"
name = "Potential Net-NTLM Coercion via Snipping Tool ms-screensketch URI (CVE-2026-33829)"
os_list = ["windows"]
reference = [
    "https://github.com/blackarrowsec/redteam-research/tree/master/CVE-2026-33829",
    "https://www.cve.org/CVERecord?id=CVE-2026-33829",
]
version = "1.0.1"

query = '''
process where event.action == "start" and
  process.name : "SnippingTool.exe" and
  (
    process.args : (
      "ms-screensketch:edit?&filePath=%5C%5C*",
      "ms-screensketch:edit?&filePath=http*",
      "ms-screensketch:edit?&filePath=\\\\*"
    ) or
    process.command_line : (
      "*ms-screensketch*edit*&filePath=%5C%5C*",
      "*ms-screensketch*edit*&filePath=http*",
      "*ms-screensketch*edit*&filePath=*\\\\*"
    )
  ) and 
  process.parent.executable != null and not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Program Files\\WindowsApps\\Microsoft.ScreenSketch_*\\SnippingTool\\SnippingTool.exe")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1187"
name = "Forced Authentication"
reference = "https://attack.mitre.org/techniques/T1187/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"