Windows LSASS crash with netlogon.dll fault and STATUS_STACK_BUFFER_OVERRUN

title: Windows LSASS crash with netlogon.dll fault and STATUS_STACK_BUFFER_OVERRUN
id: b09302ec-0fe3-4676-8e38-bcb4a2668f6e
status: experimental
description: This rule flags Application Error events where lsass.exe crashes with netlogon.dll as the faulting module and the exception code indicates STATUS_STACK_BUFFER_OVERRUN (0xc0000409). Such LSASS crashes can be an attacker-driven denial of service condition, particularly when they occur on systems that host the Netlogon component. It relies on Windows Application Error telemetry (EventID 1000) providing the faulting process, module, and exception code.
references:
  - https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
  - https://learn.microsoft.com/en-us/shows/inside/c0000409
  - https://github.com/p3Nt3st3r-sTAr/CVE-2026-41089
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-41089/win_application_error_exploit_cve_2026_41089_lsass_netlogon_crash.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-06-02
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-41089
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    AppName: lsass.exe
    ModuleName: netlogon.dll
    ExceptionCode: c0000409
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f8a66a02-4a16-46e5-b7fd-a42c8a93d137
    type: derived