CVE-2026-59264

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName has_any ("setup.exe", "install.exe")
| where ProcessCommandLine has "OpenOffice"
| where InitiatingProcessFileName != "msiexec.exe"
| where FolderPath has_any ("C:\Users\Public", "C:\Windows\Temp") // Common paths for manipulated installers
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessParentFileName

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Application)
(Image="*\\setup.exe" OR Image="*\\install.exe")
(CommandLine="*OpenOffice*")
NOT (ParentImage="*\\msiexec.exe")
(Image="C:\Users\Public\*" OR Image="C:\Windows\Temp\*")
| table _time, host, Image, CommandLine, ParentImage

Sigma

title: Apache OpenOffice Installer Uncontrolled Search Path
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious execution of Apache OpenOffice installers from common manipulated paths, indicating a potential uncontrolled search path vulnerability exploitation.
references:
  - https://www.cve.org/CVERecord?id=CVE-2026-59264
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\setup.exe'
      - '\install.exe'
    CommandLine|contains: 'OpenOffice'
    ParentImage|endswith: 'msiexec.exe'
    ParentImage|contains: 'OpenOffice'
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
  condition: selection and not ParentImage|endswith: 'msiexec.exe'
fields:
  - CommandLine
  - Image
  - ParentImage
  - User
level: high

Elastic ES|QL

from process where event.type == "start" and (process.executable.endswith("setup.exe") or process.executable.endswith("install.exe")) and process.args like "*OpenOffice*" and not process.parent.executable.endswith("msiexec.exe") and (process.executable.path like "C:\\Users\\Public\\%" or process.executable.path like "C:\\Windows\\Temp\\%") | select @timestamp, host.name, process.executable, process.args, process.parent.executable, user.name