CVE-2021-34501

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where FileName !~ "EXCEL.EXE" // Exclude Excel launching itself
| where FileName !in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe") // Common RCE child processes
| where ProcessCommandLine has_any ("http", "https", "ftp", "smb") or RemoteIP != "" // Look for network activity from child processes
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemoteUrl

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where ParentImage="*\\EXCEL.EXE"
| where Image!="*\\EXCEL.EXE"
| where Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe") OR CommandLine LIKE "%http%" OR CommandLine LIKE "%https%" OR CommandLine LIKE "%ftp%" OR CommandLine LIKE "%smb%"
| table _time, host, ParentImage, Image, CommandLine

Sigma

title: Excel RCE Child Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\EXCEL.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
level: high

Elastic ES|QL

from logs-windows.sysmon_operational-*
| where event.code == 1
| where process.parent.executable == 'EXCEL.EXE'
| where process.executable != 'EXCEL.EXE'
| where process.executable in ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe') or process.command_line : ('*http*', '*https*', '*ftp*', '*smb*')
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line