CVE-2026-62784

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "lsasrv.exe"
| where InitiatingProcessFileName != "services.exe" // lsasrv.exe wird normalerweise von services.exe gestartet
| where ProcessCommandLine contains "-rpc" or ProcessCommandLine contains "-network" // Beispiel für ungewöhnliche Parameter
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) (process_name="lsasrv.exe" OR Image="*\\lsasrv.exe") NOT (parent_process_name="services.exe" OR ParentImage="*\\services.exe")
| table _time, host, Image, CommandLine, ParentImage, ParentCommandLine, dest_ip, dest_port

Sigma

title: LSASRV Unusual Process Activity
status: experimental
description: Detects unusual process activity related to lsasrv.exe that might indicate exploitation of CVE-2026-62784.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\lsasrv.exe'
  filter:
    ParentImage|endswith: '\services.exe'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
level: high

Elastic ES|QL

FROM logs-windows.*
| WHERE event.category == "process"
| WHERE process.executable == "lsasrv.exe"
| WHERE NOT process.parent.executable == "services.exe"
| SELECT @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line