CVE-2026-65679

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "iscsitarget.exe" or InitiatingProcessCommandLine contains "iscsitarget"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe") or ProcessCommandLine contains "/c" or ProcessCommandLine contains "-exec"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational) (ParentProcessName="iscsitarget.exe" OR ParentProcessCommandLine="*iscsitarget*") (ProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe") OR CommandLine="*/c*" OR CommandLine="*-exec*") | table _time, host, ParentProcessName, ParentProcessCommandLine, ProcessName, CommandLine

Sigma

title: iSCSI Target Service Spawning Shell
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\iscsitarget.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
  condition: selection
level: high

Elastic ES|QL

from logs-windows.*
| where event.category == "process"
| where process.parent.executable == "iscsitarget.exe"
| where process.executable in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| select @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line