CVE-2026-65658

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.EXE" // SharePoint worker process or timer service
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe") or ProcessCommandLine contains "-EncodedCommand" or ProcessCommandLine contains "/c"
| where InitiatingProcessCommandLine contains "SharePoint"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) 
(ParentProcessName="w3wp.exe" OR ParentProcessName="OWSTIMER.EXE") 
(ProcessName IN ("powershell.exe", "cmd.exe", "pwsh.exe") OR CommandLine="*-EncodedCommand*" OR CommandLine="*/c*") 
| search ParentCommandLine="*SharePoint*"
| table _time, host, ParentProcessName, ParentCommandLine, ProcessName, CommandLine, Image, Hashes

Sigma

title: SharePoint Deserialization RCE Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '/c'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate SharePoint administrative scripts (requires tuning)
level: high

Elastic ES|QL

from process where
  (process.parent.executable.name == "w3wp.exe" or process.parent.executable.name == "OWSTIMER.EXE") and
  (process.executable.name == "powershell.exe" or process.executable.name == "cmd.exe" or process.executable.name == "pwsh.exe") and
  (process.args contains "-EncodedCommand" or process.args contains "/c")
select @timestamp, host.name, process.parent.executable.name, process.parent.command_line, process.executable.name, process.command_line, process.hash.sha256