CVE-2026-62823

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "dhcpserver.exe" or FileName =~ "dhcpserver.exe"
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "wmic.exe" or ProcessCommandLine contains "mshta.exe"
| where InitiatingProcessParentFileName !~ "svchost.exe" // Legitimate DHCP processes often run under svchost
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessCommandLine
| extend AlertReason = "Suspicious process spawned by DHCP server, potentially indicating RCE via heap overflow."

Splunk SPL

index=windows_events (source="WinEventLog:Microsoft-Windows-DHCP-Server/Operational" OR source="WinEventLog:System")
| search (EventCode=4688 OR EventCode=1) (ParentProcessName="dhcpserver.exe" OR ProcessName="dhcpserver.exe") (CommandLine="*powershell*" OR CommandLine="*cmd.exe*" OR CommandLine="*wmic.exe*" OR CommandLine="*mshta.exe*")
| where NOT (ParentProcessName="svchost.exe")
| table _time, host, ProcessName, ParentProcessName, CommandLine, EventCode
| rename host as DeviceName
| eval AlertReason = "Suspicious process spawned by DHCP server, potentially indicating RCE via heap overflow."

Sigma

title: DHCP Server RCE via Heap Overflow
status: experimental
description: Detects suspicious process creation originating from the DHCP server process, potentially indicating successful exploitation of a heap-based buffer overflow vulnerability (CVE-2026-62823).
references:
  - https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\dhcpserver.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wmic.exe'
      - '\mshta.exe'
  condition: selection
fields:
  - Image
  - ParentImage
  - CommandLine
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and (process.parent.executable == "dhcpserver.exe" or process.executable == "dhcpserver.exe") and (process.command_line : "*powershell*" or process.command_line : "*cmd.exe*" or process.command_line : "*wmic.exe*" or process.command_line : "*mshta.exe*") and not (process.parent.executable == "svchost.exe")
| project @timestamp, host.name, process.executable, process.parent.executable, process.command_line
| append { from process where event.category == "network" and event.type == "connection" and process.executable == "dhcpserver.exe" and destination.ip != null and destination.port != null and not (destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))
| project @timestamp, host.name, process.executable, destination.ip, destination.port
}