CVE-2026-7280 — Code Execution

title: CVE-2026-7280 - Unquoted Service Path Execution - AVACAST
id: scw-2026-04-28-ai-1
status: experimental
level: critical
description: |
  Detects the execution of the AVACAST service executable (avastsvc.exe) with a command line argument indicating it's starting, originating from a parent process like svchost.exe. This rule specifically targets the unquoted service path vulnerability (CWE-428) by looking for the service executable path. If a malicious executable is placed in a directory that is part of the unquoted path (e.g., 'C:\Program Files\eMPIA Technology\AVACAST\some_dir\malicious.exe') and the AVACAST service attempts to load it, this rule will trigger, indicating potential arbitrary code execution with system privileges when the AVACAST service starts.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7280/
tags:
  - attack.privilege_escalation
  - attack.t1547.001
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\eMPIA Technology\AVACAST\avastsvc.exe'
      CommandLine|contains:
          - ' /start'
      ParentImage|contains:
          - 'svchost.exe'
  selection_unquoted_path:
      Image|startswith:
          - 'C:\Program Files\eMPIA Technology\AVACAST\'
      TargetFilename|startswith:
          - 'C:\Program Files\eMPIA Technology\AVACAST\'
      TargetFilename|endswith:
          - '.exe'
      action:
          - 'creation'
  condition: selection AND selection_unquoted_path
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse