CVE-2026-62895

Sentinel/Defender KQL

// This query is a placeholder. Actual detection requires specific logs related to Azure Arc cross-domain communication and privilege escalation attempts.
// Look for unusual network connections from Azure Arc agents to untrusted domains, especially those involving authentication or privilege-granting operations.
// Example (conceptual, needs refinement based on actual log schema):
// AzureDiagnostics
// | where ResourceType == "AZUREARC_AGENT"
// | where Message contains "cross-domain policy violation" or Message contains "privilege escalation attempt"
// | project TimeGenerated, Resource, Message, RemoteIP, RemoteUrl

Splunk SPL

# This query is a placeholder. Actual detection requires specific logs related to Azure Arc cross-domain communication and privilege escalation attempts.
# Look for unusual network connections from Azure Arc agents to untrusted domains, especially those involving authentication or privilege-granting operations.
# Example (conceptual, needs refinement based on actual log schema):
# index=azure sourcetype=azure:arc:agent
# ("cross-domain policy violation" OR "privilege escalation attempt")
# | table _time, host, message, dest_ip, dest_url

Sigma

title: Azure Arc Permissive Cross-Domain Policy Privilege Escalation
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential privilege escalation attempts via permissive cross-domain policy in Azure Arc.
author: SecBoard
date: 2026/09/08
logsource:
  product: azure
  service: azure_arc
detection:
  selection:
    EventID: 'YourAzureArcAgentEventIDForNetworkActivity'
    Message|contains:
      - 'cross-domain policy violation'
      - 'privilege escalation attempt'
    DestinationIp|!startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '127.'
  condition: selection
level: high

Elastic ES|QL

// This query is a placeholder. Actual detection requires specific logs related to Azure Arc cross-domain communication and privilege escalation attempts.
// Look for unusual network connections from Azure Arc agents to untrusted domains, especially those involving authentication or privilege-granting operations.
// Example (conceptual, needs refinement based on actual log schema):
// from azure.arc.agent
// | where message : "cross-domain policy violation" or message : "privilege escalation attempt"
// | where not destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")
// | select @timestamp, host.name, message, destination.ip, destination.domain