CVE-2026-62832

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "profsvc.dll" or InitiatingProcessFileName =~ "svchost.exe" and ProcessCommandLine contains "profsvc"
| where FileName has_any ("lnk", "symlink", "junction") or FolderPath has_any ("C:\Users\Public", "C:\Windows\Temp")
| where ActionType == "FileCreated" or ActionType == "FileModified" or ActionType == "FileAccessed"
| where InitiatingProcessIntegrityLevel == "Low" or InitiatingProcessIntegrityLevel == "Medium"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType, InitiatingProcessIntegrityLevel
| join kind=leftouter (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "profsvc.dll" or InitiatingProcessFileName =~ "svchost.exe" and ProcessCommandLine contains "profsvc"
    | where ProcessIntegrityLevel == "System" or ProcessIntegrityLevel == "High"
    | project Timestamp, DeviceName, ElevatedProcessFileName = FileName, ElevatedProcessCommandLine = ProcessCommandLine, ElevatedProcessIntegrityLevel = ProcessIntegrityLevel
) on DeviceName
| where Timestamp between (ago(1h) .. now()) and Timestamp > Timestamp - 10m // Look for elevation shortly after suspicious activity
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ElevatedProcessFileName, ElevatedProcessIntegrityLevel
| where count_ > 0

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
(EventID=4688 OR EventID=1 OR EventID=11 OR EventID=23)
(ParentProcessName="profsvc.dll" OR ParentProcessName="svchost.exe" CommandLine="*profsvc*")
(NewProcessName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe") OR TargetFilename IN ("*.lnk", "*.symlink", "*.junction"))
| where User NOT IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\LOCAL SERVICE", "NT AUTHORITY\\NETWORK SERVICE")
| stats count by _time, host, User, ParentProcessName, CommandLine, NewProcessName, TargetFilename, Image, ProcessId, ParentProcessId
| where count > 0

Sigma

title: Windows User Profile Service Link Following EoP
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential exploitation of CVE-2026-62832 in Windows User Profile Service via unusual link following leading to privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62832
author: SecBoard Operations
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\svchost.exe'
    CommandLine|contains:
      - 'profsvc'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    # Look for suspicious file access patterns that might indicate link following
    # This is a generic behavioral rule and might require tuning
    CommandLine|contains:
      - 'mklink'
      - 'junction'
      - 'symlink'
      - 'move'
      - 'copy'
      - 'del'
  condition: all of selection_*
falsepositives:
  - Legitimate system administration tasks (requires careful tuning and baselining)
level: high

Elastic ES|QL

from process where event.type == "start" and
  (process.parent.executable == "svchost.exe" and process.parent.args : "*profsvc*") and
  (process.executable in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe") or
   process.args : ("*mklink*", "*junction*", "*symlink*", "*move*", "*copy*", "*del*"))
| stats count() by host.name, user.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line
| where count > 0