CVE-2026-62815

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("msquic.dll", "quic.sys")
| where ActionType == "ConnectionAttempt" or ActionType == "ConnectionSuccess"
| summarize ConnectionCount = count() by RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount > 100 // Adjust threshold based on baseline
| project RemoteIP, RemotePort, InitiatingProcessFileName, ConnectionCount, TimeGenerated
// Further investigation needed for unusual process behavior or high connection rates from unexpected sources.
// This is a generic behavioral query and needs tuning for specific QUIC implementations and attack patterns.

Splunk SPL

index=* (msquic.dll OR quic.sys) (ConnectionAttempt OR ConnectionSuccess)
| stats count as ConnectionCount by dest_ip, dest_port, process_name
| where ConnectionCount > 100
| table dest_ip, dest_port, process_name, ConnectionCount, _time
| rename dest_ip as RemoteIP, dest_port as RemotePort, process_name as InitiatingProcessFileName
// Further investigation needed for unusual process behavior or high connection rates from unexpected sources.
// This is a generic behavioral query and needs tuning for specific QUIC implementations and attack patterns.

Sigma

title: Microsoft QUIC Use After Free RCE Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation attempts of CVE-2026-62815 in Microsoft QUIC by monitoring unusual network activity.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-62815
author: SecBoard
date: 2026/08/11
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: 
            - 'msquic.dll'
            - 'quic.sys'
        Initiated: 'true'
        DestinationPort: 
            - 443 # Default QUIC port
            - 80 # Potential alternative for HTTP/3 over QUIC
    condition: selection
falsepositives:
    - Legitimate QUIC traffic
level: high
// This is a generic behavioral query and needs tuning for specific QUIC implementations and attack patterns.

Elastic ES|QL

from network.connection
| where process.executable.path : ("*\\msquic.dll", "*\\quic.sys")
| where event.action == "connection_attempt" or event.action == "connection_success"
| stats count() as connection_count by destination.ip, destination.port, process.executable.path
| where connection_count > 100
| project destination.ip, destination.port, process.executable.path, connection_count, @timestamp
// Further investigation needed for unusual process behavior or high connection rates from unexpected sources.
// This is a generic behavioral query and needs tuning for specific QUIC implementations and attack patterns.