CVE-2026-105718

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where ProcessCommandLine has_any ("/c", "/k", "powershell", "cmd.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 | Image="*EXCEL.EXE" | CommandLine IN ("*/c*", "*/k*", "*powershell*", "*cmd.exe*") | table _time, Hostname, Image, CommandLine, ParentImage, Hashes

Sigma

title: Excel Spawns Suspicious Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\EXCEL.EXE'
    CommandLine|contains:
      - '/c'
      - '/k'
      - 'powershell'
      - 'cmd.exe'
  condition: selection
level: high

Elastic ES|QL

from process where event.type == "start" and process.parent.executable : "*EXCEL.EXE" and (process.args : "/c" or process.args : "/k" or process.command_line : "*powershell*" or process.command_line : "*cmd.exe*")