CVE-2026-63513

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "visio.exe", "access.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
  or FolderPath contains "\\Temp\\" or FolderPath contains "\\AppData\\Local\\Temp\\"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) EventCode=1
| where InitiatingProcessName IN ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "visio.exe", "access.exe")
| where NewProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
  OR NewProcessPath LIKE "%\\Temp\\%" OR NewProcessPath LIKE "%\\AppData\\Local\\Temp\\%"
| table _time, host, InitiatingProcessName, NewProcessName, NewProcessPath, CommandLine, ParentCommandLine

Sigma

title: Microsoft Office Heap Buffer Overflow - Local Code Execution
status: experimental
description: Detects suspicious child processes spawned by Microsoft Office applications, indicative of potential exploitation of a heap-based buffer overflow vulnerability.
author: SecBoard
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\VISIO.EXE'
      - '\ACCESS.EXE'
  selection_child_process:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
    Image|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
  condition: selection and selection_child_process
level: high

Elastic ES|QL

from process where
  process.parent.name in ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "visio.exe", "access.exe") and
  (process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe") or
   process.executable.path : "*\\Temp\\*" or process.executable.path : "*\\AppData\\Local\\Temp\\*")
| select @timestamp, host.name, process.parent.name, process.name, process.executable.path, process.command_line, process.parent.command_line