CVE-2026-54118

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe", "sh.exe", "bash.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 New_Process_Name IN ("powershell.exe", "cmd.exe", "pwsh.exe", "sh.exe", "bash.exe") Parent_Process_Name="sqlservr.exe" | table _time, host, Parent_Process_Name, New_Process_Name, CommandLine

Sigma

title: SQL Server Deserialization RCE Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
level: high

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "sqlservr.exe" and process.executable in ("powershell.exe", "cmd.exe", "pwsh.exe", "sh.exe", "bash.exe") | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line