CVE-2026-27105 — Arbitrary File Access

title: CVE-2026-27105 - Dell/Alienware Purchased Apps Arbitrary File Write via Improper Link Resolution
id: scw-2026-04-29-ai-1
status: experimental
level: high
description: |
  This rule detects the specific arbitrary file write vulnerability in Dell/Alienware Purchased Apps (CVE-2026-27105). It looks for attempts to write to the Windows hosts file by exploiting the Improper Link Resolution Before File Access vulnerability in Dell.DigitalDelivery.Service.exe, allowing a low-privileged attacker to modify system network configurations.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-27105/
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|contains:
          - 'C:\Program Files\Dell\Dell Digital Delivery Service\Dell.DigitalDelivery.Service.exe'
      TargetObject|contains:
          - '..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse