CVE-2026-67380

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe")
| summarize count() by DeviceName, FileName, InitiatingProcessCommandLine, CommandLine
| where count_ > 0

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 NewProcessName IN ("powershell.exe", "cmd.exe", "pwsh.exe") ParentProcessName="sqlservr.exe"
| table _time, host, ParentProcessName, NewProcessName, CommandLine

Sigma

title: SQL Server Spawns Shell
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects suspicious process creation by SQL Server, potentially indicating a successful exploit.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67380
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.67380

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "sqlservr.exe" and process.executable in ("powershell.exe", "cmd.exe", "pwsh.exe") | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line