CVE-2026-66808

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "OWSTIMER.EXE" // SharePoint worker processes
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe") // Common shell processes
| where ProcessCommandLine has_any ("-e", "-enc", "-decode", "-c", "/c") // Suspicious command line arguments
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=windows (ParentProcessName=w3wp.exe OR ParentProcessName=OWSTIMER.EXE) (ProcessName=powershell.exe OR ProcessName=cmd.exe OR ProcessName=pwsh.exe) (CommandLine="-e" OR CommandLine="-enc" OR CommandLine="-decode" OR CommandLine="-c" OR CommandLine="/c")
| table _time, host, ParentProcessName, ProcessName, CommandLine

Sigma

title: SharePoint Deserialization RCE Attempt
author: SecBoard
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\OWSTIMER.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  selection_cmdline:
    CommandLine|contains:
      - '-e'
      - '-enc'
      - '-decode'
      - '-c'
      - '/c'
  condition: selection_parent and selection_child and selection_cmdline
level: high

Elastic ES|QL

from process where (process.parent.executable.keyword : ("*\\w3wp.exe", "*\\OWSTIMER.EXE")) and (process.executable.keyword : ("*\\powershell.exe", "*\\cmd.exe", "*\\pwsh.exe")) and (process.args : ("-e", "-enc", "-decode", "-c", "/c")) | project @timestamp, host.name, process.parent.executable, process.executable, process.command_line