CVE-2026-68820

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName !in ("explorer.exe", "svchost.exe", "winlogon.exe", "services.exe")
| where ProcessCommandLine contains "afd.sys" or ProcessCommandLine contains "winsock"
| where ProcessIntegrityLevel == "Low" or ProcessIntegrityLevel == "Medium"
| where FileName in ("cmd.exe", "powershell.exe", "wmic.exe", "sc.exe") or FolderPath contains "\\Windows\\System32\\"
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=windows_events (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 or EventCode=7)
| where (Image_Path LIKE "%afd.sys%" OR Image_Path LIKE "%winsock%") AND (Parent_Image_Path NOT IN ("*\\explorer.exe", "*\\svchost.exe", "*\\winlogon.exe", "*\\services.exe"))
| where (Integrity_Level="Low" OR Integrity_Level="Medium")
| where (Image_Name IN ("cmd.exe", "powershell.exe", "wmic.exe", "sc.exe") OR Image_Path LIKE "%\\Windows\\System32\\%")
| stats count by ComputerName, Parent_Image_Name, CommandLine, Image_Name, Image_Path

Sigma

title: Windows AFD.sys LPE Attempt
status: experimental
description: Detects suspicious process activity potentially related to CVE-2026-68820 exploitation, focusing on non-privileged processes interacting with kernel components or escalating privileges.
references:
    - https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\svchost.exe'
            - '\winlogon.exe'
            - '\services.exe'
        ParentImage|contains:
            - 'afd.sys'
            - 'winsock'
        IntegrityLevel:
            - 'Low'
            - 'Medium'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wmic.exe'
            - '\sc.exe'
            - '\System32\*'
    condition: not selection
fields:
    - ComputerName
    - ParentImage
    - CommandLine
    - Image
level: high

Elastic ES|QL

from process where event.type == "start" and
  (process.parent.executable != "explorer.exe" and process.parent.executable != "svchost.exe" and process.parent.executable != "winlogon.exe" and process.parent.executable != "services.exe") and
  (process.command_line : "*afd.sys*" or process.command_line : "*winsock*") and
  (process.integrity_level == "low" or process.integrity_level == "medium") and
  (process.executable : ("*\\cmd.exe", "*\\powershell.exe", "*\\wmic.exe", "*\\sc.exe") or process.executable : "*\\Windows\\System32\\*")
| summarize count() by host.name, process.parent.executable, process.command_line, process.executable