CVE-2026-100210

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where ProcessCommandLine has_any (".xls", ".xlsx", ".xlsm")
| where ProcessCommandLine contains "/e" or ProcessCommandLine contains "/dde"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where ParentImage="C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" OR ParentImage="C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
| where Image!=ParentImage
| stats count by Image, ParentImage, CommandLine, User
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`

Sigma

title: Excel Heap-based Buffer Overflow Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\EXCEL.EXE'
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - '/c'
      - '/k'
      - 'powershell'
      - 'cmd'
  condition: selection

Elastic ES|QL

FROM process WHERE event.action == "process_started" AND process.parent.name == "EXCEL.EXE" AND process.executable.name IN ("cmd.exe", "powershell.exe") AND process.args IN ("/c", "/k")