CVE-2026-63520

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.EXE" // SharePoint-Prozesse
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "sh.exe", "bash.exe") // Ungewöhnliche Shell-Starts
| where ProcessCommandLine has_any ("http", "https", "ftp", "nc", "ncat", "curl", "wget") // Netzwerk-Tools in der Befehlszeile
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessCommandLine
| extend DetectionGuidance = "Überprüfen Sie ungewöhnliche Prozessstarts oder Netzwerkaktivitäten von SharePoint-Servern, die auf eine Code-Ausführung hindeuten könnten."

Splunk SPL

index=your_windows_logs (ParentProcessName="w3wp.exe" OR ParentProcessName="OWSTIMER.EXE") (ProcessName="cmd.exe" OR ProcessName="powershell.exe" OR ProcessName="pwsh.exe" OR ProcessName="sh.exe" OR ProcessName="bash.exe") (CommandLine=*http* OR CommandLine=*https* OR CommandLine=*ftp* OR CommandLine=*nc* OR CommandLine=*ncat* OR CommandLine=*curl* OR CommandLine=*wget*)
| table _time, host, ParentProcessName, ProcessName, CommandLine
| rename _time as TimeGenerated, host as DeviceName, ParentProcessName as InitiatingProcessFileName, ProcessName as FileName, CommandLine as ProcessCommandLine
| eval DetectionGuidance = "Überprüfen Sie ungewöhnliche Prozessstarts oder Netzwerkaktivitäten von SharePoint-Servern, die auf eine Code-Ausführung hindeuten könnten."

Sigma

title: SharePoint RCE via Input Validation
status: experimental
description: Detects potential remote code execution on SharePoint servers due to improper input validation, indicated by unusual shell or network tool execution originating from SharePoint processes.
author: SecBoard
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
    CommandLine|contains:
      - 'http'
      - 'https'
      - 'ftp'
      - 'nc'
      - 'ncat'
      - 'curl'
      - 'wget'
  condition: selection
level: high

Elastic ES|QL

from process where
  (process.parent.executable.endswith('w3wp.exe') or process.parent.executable.endswith('OWSTIMER.EXE')) and
  (process.executable.endswith('cmd.exe') or process.executable.endswith('powershell.exe') or process.executable.endswith('pwsh.exe') or process.executable.endswith('sh.exe') or process.executable.endswith('bash.exe')) and
  (process.args contains 'http' or process.args contains 'https' or process.args contains 'ftp' or process.args contains 'nc' or process.args contains 'ncat' or process.args contains 'curl' or process.args contains 'wget')
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line
| append {
    from process where
      (process.parent.executable.endswith('w3wp.exe') or process.parent.executable.endswith('OWSTIMER.EXE')) and
      (process.executable.endswith('cmd.exe') or process.executable.endswith('powershell.exe') or process.executable.endswith('pwsh.exe') or process.executable.endswith('sh.exe') or process.executable.endswith('bash.exe')) and
      (process.command_line contains 'http' or process.command_line contains 'https' or process.command_line contains 'ftp' or process.command_line contains 'nc' or process.command_line contains 'ncat' or process.command_line contains 'curl' or process.command_line contains 'wget')
    | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line
  }
| eval DetectionGuidance = 'Überprüfen Sie ungewöhnliche Prozessstarts oder Netzwerkaktivitäten von SharePoint-Servern, die auf eine Code-Ausführung hindeuten könnten.'