CVE-2026-42897

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("outlook.exe", "iexplore.exe", "chrome.exe", "msedge.exe", "firefox.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("-EncodedCommand", "/c", "/k")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName
// Further refinement needed to specifically target OWA context and XSS-driven execution.
// Consider monitoring network connections from browser processes to unusual C2 domains/IPs if IOCs become available.

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 OR sourcetype=WinEventLog:Microsoft-Windows-Security-Auditing EventCode=4688)
(ParentProcessName IN ("outlook.exe", "iexplore.exe", "chrome.exe", "msedge.exe", "firefox.exe"))
(ProcessName IN ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe"))
(CommandLine IN ("*-EncodedCommand*", "*/c*", "*/k*"))
| table _time, host, ParentProcessName, ProcessName, CommandLine
# Further refinement needed to specifically target OWA context and XSS-driven execution.
# Consider monitoring network connections from browser processes to unusual C2 domains/IPs if IOCs become available.

Sigma

title: OWA XSS Exploitation Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation of CVE-2026-42897 via suspicious process creation from browser context.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\iexplore.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '/c'
      - '/k'
  condition: selection
fields:
  - Image
  - ParentImage
  - CommandLine
tags:
  - attack.execution
  - cve.2026.42897
  - exploitation
level: high

Elastic ES|QL

from process where
  (process.parent.executable in ("outlook.exe", "iexplore.exe", "chrome.exe", "msedge.exe", "firefox.exe")) and
  (process.executable in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")) and
  (process.args contains any ("-EncodedCommand", "/c", "/k"))
select @timestamp, host.name, process.parent.executable, process.executable, process.command_line
// Further refinement needed to specifically target OWA context and XSS-driven execution.
// Consider monitoring network connections from browser processes to unusual C2 domains/IPs if IOCs become available.