CVE-2026-62818

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "certsvc.exe" or FileName =~ "certsvc.exe"
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "mshta.exe" or ProcessCommandLine contains "wscript.exe" or ProcessCommandLine contains "cscript.exe"
| where InitiatingProcessParentFileName != "services.exe"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessIntegrityLevel, InitiatingProcessAccountName
| extend EventType = "ADCS_UAF_RCE_Attempt"

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Application)
(ProcessName="certsvc.exe" OR ParentProcessName="certsvc.exe")
(CommandLine="*powershell*" OR CommandLine="*cmd.exe*" OR CommandLine="*mshta.exe*" OR CommandLine="*wscript.exe*" OR CommandLine="*cscript.exe*")
| where NOT ParentProcessName="services.exe"
| table _time, host, ProcessName, ParentProcessName, CommandLine, User

Sigma

title: AD CS Use-After-Free RCE Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of a Use-After-Free vulnerability in Active Directory Certificate Services (AD CS) leading to remote code execution.
author: SecBoard
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\certsvc.exe'
    CommandLine|contains:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'mshta.exe'
      - 'wscript.exe'
      - 'cscript.exe'
  condition: selection
falsepositives:
  - Legitimate AD CS operations that involve spawning shell processes (unlikely).
level: high

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "certsvc.exe" or process.executable == "certsvc.exe") and (process.command_line : "*powershell*" or process.command_line : "*cmd.exe*" or process.command_line : "*mshta.exe*" or process.command_line : "*wscript.exe*" or process.command_line : "*cscript.exe*") and process.parent.executable != "services.exe"
| select @timestamp, host.name, process.executable, process.parent.executable, process.command_line, user.name