CVE-2026-62893

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "wdstftp.exe" or InitiatingProcessFileName =~ "wdstftp.exe"
| where ActionType == "ProcessCreated" or ActionType == "NetworkConnectionInitiated"
| where InitiatingProcessCommandLine contains "/tftp"
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine
// Further refine by looking for unusual child processes or network activity from wdstftp.exe

Splunk SPL

index=windows (process_name="wdstftp.exe" OR parent_process_name="wdstftp.exe")
| search (eventtype=process_creation OR eventtype=network_connection)
| search command_line="* /tftp*"
| table _time, host, process_name, parent_process_name, command_line, dest_ip, dest_port
// Further refine by looking for unusual child processes or network activity from wdstftp.exe

Sigma

title: Windows Deployment Services TFTP Server RCE Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wdstftp.exe'
    CommandLine|contains: '/tftp'
  condition: selection
  # Further refine by looking for unusual child processes or network activity from wdstftp.exe
level: critical

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.executable.text == "wdstftp.exe" or process.parent.executable.text == "wdstftp.exe"
| where process.command_line.text : "* /tftp*"
| project @timestamp, host.name, process.executable.text, process.parent.executable.text, process.command_line.text, destination.ip, destination.port
// Further refine by looking for unusual child processes or network activity from wdstftp.exe