CVE-2026-54117

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
  or (FileName !~ "sqlservr.exe" and ProcessCommandLine has_any ("-EncodedCommand", "Invoke-Expression", "Start-Process", "net user", "net localgroup", "whoami"))
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine

Splunk SPL

index=your_windows_index (ParentProcessName="sqlservr.exe" AND (ProcessName IN ("powershell.exe", "cmd.exe", "pwsh.exe", "wscript.exe", "cscript.exe") OR (NOT ProcessName="sqlservr.exe" AND CommandLine IN ("-EncodedCommand", "Invoke-Expression", "Start-Process", "net user", "net localgroup", "whoami")))) | table _time, host, ParentProcessName, ProcessName, CommandLine, ProcessPath

Sigma

title: SQL Server Deserialization RCE Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - 'Invoke-Expression'
      - 'Start-Process'
      - 'net user'
      - 'net localgroup'
      - 'whoami'
  condition: selection
falsepositives:
  - Legitimate SQL Server administrative scripts (requires tuning)
level: high

Elastic ES|QL

from process where event.action == "process_started" and process.parent.executable == "sqlservr.exe" and (process.executable in ("powershell.exe", "cmd.exe", "pwsh.exe", "wscript.exe", "cscript.exe") or (process.executable != "sqlservr.exe" and process.args in ("-EncodedCommand", "Invoke-Expression", "Start-Process", "net user", "net localgroup", "whoami"))) | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.working_directory