Windows: Detect LSASS crashes caused by netlogon.dll stack buffer overrun (STATUS_STACK_BUFFER_OVERRUN)
Alerts on lsass.exe crashes blamed on netlogon.dll with STATUS_STACK_BUFFER_OVERRUN (0xc0000409) in Windows Application Error (EventID 1000).
- Product
- windows
- Service
- application
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-06-02
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows Application Error events where lsass.exe crashes with netlogon.dll as the faulting module and the exception code indicates STATUS_STACK_BUFFER_OVERRUN (0xc0000409). A crash of the Local Security Authority Subsystem Service is significant because it can disrupt authentication and indicate malicious exploitation attempts against Netlogon. It relies on Windows Application Error telemetry (EventID 1000) capturing the faulting process, module name, and exception code.
Reporting behind it
- aretiq.aihttps://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/shows/inside/c0000409
- github.comhttps://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-41089/win_application_error_exploit_cve_2026_41089_lsass_netlogon_crash.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect LSASS crashes caused by netlogon.dll stack buffer overrun (STATUS_STACK_BUFFER_OVERRUN)"
id: b09302ec-0fe3-4676-8e38-bcb4a2668f6e
status: experimental
description: This rule flags Windows Application Error events where lsass.exe crashes with netlogon.dll as the faulting module and the exception code indicates STATUS_STACK_BUFFER_OVERRUN (0xc0000409). A crash of the Local Security Authority Subsystem Service is significant because it can disrupt authentication and indicate malicious exploitation attempts against Netlogon. It relies on Windows Application Error telemetry (EventID 1000) capturing the faulting process, module name, and exception code.
references:
- https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
- https://learn.microsoft.com/en-us/shows/inside/c0000409
- https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-41089/win_application_error_exploit_cve_2026_41089_lsass_netlogon_crash.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-06-02
tags:
- attack.impact
- attack.t1499
- cve.2026-41089
- detection.emerging-threats
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
AppName: lsass.exe
ModuleName: netlogon.dll
ExceptionCode: c0000409
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f8a66a02-4a16-46e5-b7fd-a42c8a93d137
type: derived