alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Microsoft Windows Admin Center Elevation of Privilege (CVE-2026-26119)"; flow:established,to_server; http.uri; content:"/api/services/WinREST/Powershell/nodes/InvokeCommand"; fast_pattern; http.request_body; strip_whitespace; content:"|22|script|22 3a 22|"; pcre:"/^[^\x22]*?[\x3b\x26\x60\x7c\x24]/R"; http.method; content:"POST"; reference:url,www.semperis.com/blog/what-you-need-to-know-windows-admin-center-remote-privilege-escalation-cve-2026-26119/; reference:cve,2026-26119; classtype:attempted-admin; sid:2071600; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2026_08_19, cve CVE_2026_26119, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_08_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)