CVE-2026-100211

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where ProcessCommandLine contains "-payload" or ProcessCommandLine contains "-macro"
| where FileName !~ "EXCEL.EXE"
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
Image="*excel.exe" CommandLine="*-payload*" OR CommandLine="*-macro*" NOT Image="*excel.exe"
| stats count by ComputerName, Image, CommandLine

Sigma

title: Excel Child Process with Suspicious Arguments
status: experimental
description: Detects suspicious child processes launched by Excel, potentially indicating exploitation of a Use-After-Free vulnerability.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\EXCEL.EXE'
    CommandLine|contains:
      - '-payload'
      - '-macro'
  filter:
    Image|endswith: '\EXCEL.EXE'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - attack.t1204.002

Elastic ES|QL

from process where event.type == "start" and process.parent.executable : "EXCEL.EXE" and (process.args : "-payload" or process.args : "-macro") and not process.executable : "EXCEL.EXE" | stats count() by host.name, process.parent.executable, process.executable, process.command_line