CVE-2026-20044

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "cli" and ProcessCommandLine contains "root" and ProcessCommandLine !contains "expert cli" // Filter for CLI commands that result in root execution, excluding expected 'expert cli' if lockdown is off
| where DeviceName contains "FMC" // Adjust based on your FMC device naming convention
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName, UserSid

Splunk SPL

index=your_fmc_logs sourcetype=cisco:fmc:cli (command="*" AND user="*" AND privilege="root") | where NOT command="expert cli" | table _time, host, user, command, privilege

Sigma

title: Cisco FMC Command Injection Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to exploit CVE-2026-20044 in Cisco FMC by monitoring for unusual root command execution via CLI.
author: SecBoard
date: 2026/03/04
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    event_type: cli_command_execution
    user_privilege: root
    command|contains: 
      - 'system'
      - 'exec'
      - 'run'
    command|not contains: 'expert cli'
  condition: selection
level: high

Elastic ES|QL

from logs-cisco.fmc-*
| where event.category == "command" and user.privileges == "root" and process.command_line : ("system", "exec", "run") and not process.command_line : "expert cli"
| select @timestamp, host.name, user.name, process.command_line