CVE-2026-45585 — Microsoft is aware of a security feature bypass

title: Possible YellowKey Security Feature Bypass Attempt (CVE-2026-45585) - Free Tier
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of cmd.exe or powershell.exe with command lines indicative of the 'YellowKey' vulnerability (CVE-2026-45585). Specifically, it looks for patterns involving 'regsvr32' with remote script execution via HTTP/HTTPS and the 'scrobj.dll' component, which is a known vector for this bypass.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45585/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'cmd.exe'
          - 'powershell.exe'
      CommandLine|contains:
          - 'regsvr32'
          - '/i:http'
          - '/i:https'
          - 'scrobj.dll'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse