CVE-2026-12647

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "iisexpress.exe" // Oder anderer relevanter Webserver-Prozess
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "python", "perl", "php")
| where ProcessCommandLine has_any ("-c", "-e", "-exec", "invoke-expression", "iex")
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, bin(Timestamp, 1h)

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 OR sourcetype=iis_access) (ParentImage="*\\w3wp.exe" OR ParentImage="*\\iisexpress.exe") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\sh" OR Image="*\\bash" OR Image="*\\python*" OR Image="*\\perl*" OR Image="*\\php*") (CommandLine="*-c*" OR CommandLine="*-e*" OR CommandLine="*-exec*" OR CommandLine="*invoke-expression*" OR CommandLine="*iex*") | stats count by host, ParentImage, Image, CommandLine

Sigma

title: Ivanti Neurons ITSM Remote Code Execution Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential remote code execution attempts via Ivanti Neurons for ITSM by monitoring suspicious process creations from web server processes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-12647
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\iisexpress.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh'
      - '\bash'
      - '\python.exe'
      - '\perl.exe'
      - '\php.exe'
    CommandLine|contains:
      - '-c'
      - '-e'
      - '-exec'
      - 'invoke-expression'
      - 'iex'
  condition: selection
level: high

Elastic ES|QL

from process where
  (process.parent.executable.endswith('w3wp.exe') or process.parent.executable.endswith('iisexpress.exe')) and
  (process.executable.endswith('cmd.exe') or process.executable.endswith('powershell.exe') or process.executable.endswith('pwsh.exe') or process.executable.endswith('sh') or process.executable.endswith('bash') or process.executable.endswith('python.exe') or process.executable.endswith('perl.exe') or process.executable.endswith('php.exe')) and
  (process.args contains '-c' or process.args contains '-e' or process.args contains '-exec' or process.command_line contains 'invoke-expression' or process.command_line contains 'iex')
|
  stats count() by host.name, process.parent.executable, process.executable, process.command_line, @timestamp