CVE-2026-69829

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("explorer.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c"
| where InitiatingProcessFileName == "explorer.exe"
| where ProcessCommandLine !contains "/k"
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| where count_ > 5 // Adjust threshold as needed for your environment
| project DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, count_

Splunk SPL

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
(EventCode=4688 OR EventCode=1)
(NewProcessName IN ("*\\explorer.exe", "*\\cmd.exe", "*\\powershell.exe"))
| where CommandLine LIKE "%-c%" OR CommandLine LIKE "% /c%"
| where ParentProcessName LIKE "*\\explorer.exe"
| where NOT CommandLine LIKE "% /k%"
| stats count by Host, ParentProcessName, NewProcessName, CommandLine
| where count > 5
| table Host, ParentProcessName, NewProcessName, CommandLine, count

Sigma

title: Windows Shell Heap Overflow Anomaly
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects unusual process creation patterns potentially indicative of a heap-based buffer overflow in Windows Shell.
author: SecBoard Operations
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - '-c'
      - '/c'
  filter:
    CommandLine|contains: '/k'
  condition: selection and not filter
  timeframe: 5m
  level: medium
falsepositives:
  - Legitimate administrative scripts
  - Software installations
tags:
  - attack.execution
  - cve.2026.69829

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "explorer.exe" and (process.executable == "cmd.exe" or process.executable == "powershell.exe") and (process.args contains "-c" or process.args contains "/c") and not (process.args contains "/k") | summarize process_count = count() by host.name, process.parent.executable, process.executable, process.args | where process_count > 5