CVE-2026-62824

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "mstsc.exe" // Remote Desktop Client process
| where ProcessCommandLine contains "/v:" // RDP connection attempt
| where InitiatingProcessFileName != "explorer.exe" // Not initiated by user directly
| where ProcessIntegrityLevel == "System" or ProcessIntegrityLevel == "High" // Elevated privileges
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemotePort
| where count_ > 5 // Adjust threshold for unusual activity
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 New_Process_Name="*mstsc.exe*" 
| where NOT Parent_Process_Name="*explorer.exe*" 
| stats count by ComputerName, New_Process_Name, CommandLine, Parent_Process_Name 
| where count > 5

Sigma

title: RDP Client Stack Buffer Overflow Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mstsc.exe'
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains: '/v:'
  condition: selection
  timeframe: 5m
  level: high

Elastic ES|QL

from process where process.executable.endswith('mstsc.exe') and not process.parent.executable.endswith('explorer.exe') and process.args contains '/v:' | stats count() by host.name, process.executable, process.command_line, process.parent.executable | where count > 5