CVE-2026-63515

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where ProcessCommandLine has_any ("/c", "cmd.exe", "powershell.exe") or FileName in~ ("cmd.exe", "powershell.exe")
| where InitiatingProcessIntegrityLevel == "Medium" // Office apps typically run at medium integrity
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (ParentProcessName IN ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")) (NewProcessName IN ("cmd.exe", "powershell.exe") OR CommandLine IN ("*/c*", "*cmd.exe*", "*powershell.exe*"))
| stats count by ComputerName, ParentProcessName, NewProcessName, CommandLine

Sigma

title: Microsoft Office Out-of-Bounds Read - Local Code Execution
author: SecBoard
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - '/c'
      - 'cmd.exe'
      - 'powershell.exe'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - Image
level: high

Elastic ES|QL

from process where event.type == "start" and 
  (process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")) and 
  (process.name : ("cmd.exe", "powershell.exe") or process.args : ("/c", "cmd.exe", "powershell.exe"))
| stats count() by host.name, process.parent.name, process.name, process.command_line