CVE-2026-62878

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "dns.exe"
| where ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "wscript.exe" or ProcessCommandLine contains "cscript.exe"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Microsoft-Windows-DNS-Server/Analytical) 
| search (ParentProcessName="dns.exe" OR ProcessName="dns.exe") (CommandLine=*powershell* OR CommandLine=*cmd.exe* OR CommandLine=*wscript.exe* OR CommandLine=*cscript.exe*)
| table _time, host, ParentProcessName, ProcessName, CommandLine

Sigma

title: DNS Server RCE via Buffer Overflow
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\dns.exe'
    CommandLine|contains:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'wscript.exe'
      - 'cscript.exe'
  condition: selection
level: critical

Elastic ES|QL

from logs-windows.event.security-*
| where event.code == "4688" // Process Creation
| where process.parent.executable == "dns.exe"
| where process.command_line : ("*powershell.exe*", "*cmd.exe*", "*wscript.exe*", "*cscript.exe*")
| select @timestamp, host.name, process.parent.executable, process.command_line, process.executable, process.hash.sha256