CVE-2026-62911

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4624 // Successful logon
| extend LogonType = tostring(TargetLogonId)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), LogonCount = count() by Account, IpAddress, LogonType
| where LogonCount > 1 // Look for multiple logons from the same account/IP within a short timeframe
| project Account, IpAddress, LogonType, FirstSeen, LastSeen, LogonCount
| join kind=leftouter (
    SecurityEvent
    | where EventID == 4624 // Successful logon
    | extend LogonType = tostring(TargetLogonId)
    | summarize by Account, IpAddress, LogonType, AuthenticationPackageName, ProcessName, WorkstationName
) on Account, IpAddress, LogonType
| where AuthenticationPackageName == "Kerberos" or AuthenticationPackageName == "NTLM"
| project-away AuthenticationPackageName, ProcessName, WorkstationName // Customize as needed
// Further analysis needed to detect replay attacks, e.g., comparing timestamps of authentication tokens if available in logs

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4624
| stats min(_time) as FirstSeen, max(_time) as LastSeen, count as LogonCount by Account_Name, IpAddress, Logon_Type
| where LogonCount > 1
| join type=left (
    index=windows sourcetype=WinEventLog:Security EventCode=4624
    | stats latest(Authentication_Package_Name) as AuthenticationPackageName, latest(Process_Name) as ProcessName, latest(Workstation_Name) as WorkstationName by Account_Name, IpAddress, Logon_Type
) on Account_Name, IpAddress, Logon_Type
| where AuthenticationPackageName="Kerberos" OR AuthenticationPackageName="NTLM"
| table Account_Name, IpAddress, Logon_Type, FirstSeen, LastSeen, LogonCount, AuthenticationPackageName, ProcessName, WorkstationName

Sigma

title: Exchange Server Authentication Bypass Replay Attempt
status: experimental
description: Detects potential authentication bypass attempts on Exchange Server via capture-replay by looking for unusual authentication patterns.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62911
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    AuthenticationPackageName|contains: # Adjust based on actual Exchange authentication methods
      - 'Kerberos'
      - 'NTLM'
  timeframe: 5m # Look for multiple events within a short timeframe
  condition: selection | group by TargetUserName, IpAddress | count() > 1
  fields:
    - TargetUserName
    - IpAddress
    - LogonType
    - AuthenticationPackageName
level: high

Elastic ES|QL

FROM winlog.security
| WHERE event.code == 4624
| WHERE winlog.event_data.AuthenticationPackageName IN ('Kerberos', 'NTLM')
| GROUP BY winlog.event_data.TargetUserName, source.ip, winlog.event_data.LogonType
| AGGREGATE first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), logon_count = COUNT()
| WHERE logon_count > 1
| JOIN (
    FROM winlog.security
    | WHERE event.code == 4624
    | SELECT winlog.event_data.TargetUserName, source.ip, winlog.event_data.LogonType, winlog.event_data.AuthenticationPackageName, winlog.event_data.ProcessName, winlog.event_data.WorkstationName
    | DEDUP winlog.event_data.TargetUserName, source.ip, winlog.event_data.LogonType
) ON winlog.event_data.TargetUserName = winlog.event_data.TargetUserName AND source.ip = source.ip AND winlog.event_data.LogonType = winlog.event_data.LogonType
| SELECT winlog.event_data.TargetUserName, source.ip, winlog.event_data.LogonType, first_seen, last_seen, logon_count, winlog.event_data.AuthenticationPackageName, winlog.event_data.ProcessName, winlog.event_data.WorkstationName