CVE-2026-70130

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "access.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
| where ProcessCommandLine !contains "/c " and ProcessCommandLine !contains "-command " // Filter out legitimate script execution if possible
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| where count_ > 1 // Adjust threshold as needed for your environment

Splunk SPL

index=your_endpoint_index (ParentProcessName=winword.exe OR ParentProcessName=excel.exe OR ParentProcessName=outlook.exe OR ParentProcessName=powerpnt.exe OR ParentProcessName=access.exe) (ProcessName=cmd.exe OR ProcessName=powershell.exe OR ProcessName=pwsh.exe OR ProcessName=wscript.exe OR ProcessName=cscript.exe OR ProcessName=mshta.exe OR ProcessName=regsvr32.exe OR ProcessName=rundll32.exe)
| where NOT (CommandLine LIKE "/c %" OR CommandLine LIKE "-command %")
| stats count by host, ParentProcessName, ProcessName, CommandLine, ProcessPath
| where count > 1

Sigma

title: Microsoft Office Child Process Execution
status: experimental
description: Detects suspicious child process creation by Microsoft Office applications, indicative of potential exploitation of vulnerabilities like buffer overflows.
author: SecBoard Operations
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\OUTLOOK.EXE'
      - '\POWERPNT.EXE'
      - '\ACCESS.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  filter:
    CommandLine|contains:
      - '/c '
      - '-command '
  condition: selection and not filter
level: high

Elastic ES|QL

FROM process WHERE
  (process.parent.executable.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "access.exe")) AND
  (process.executable.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")) AND
  NOT (process.args : ("/c", "-command"))