CVE-2026-100209

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where ProcessCommandLine has_any ("/automation", "/embedding") // Example behavioral indicators for Excel RCE
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 NewProcessName="excel.exe" CommandLine IN ("*/automation*", "*/embedding*") | table _time, host, NewProcessName, CommandLine, ParentProcessName

Sigma

title: Excel RCE Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential remote code execution attempts via Microsoft Excel.
author: SecBoard
date: 2026/10/13
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\EXCEL.EXE'
    CommandLine|contains:
      - '/automation'
      - '/embedding'
  condition: selection
level: high

Elastic ES|QL

from process where process.executable.name : "EXCEL.EXE" and (process.args : "/automation" or process.args : "/embedding") | select @timestamp, host.name, process.executable.name, process.command_line, process.parent.executable.name