CVE-2026-73028

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4624 and TargetLogonId != "0x0" // Successful logon events
| where SubjectUserName != TargetUserName // Look for privilege escalation attempts
| where ProcessName has "sqlservr.exe" or CommandLine has "sqlcmd" // Related to SQL Server processes
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, ProcessName, CommandLine, EventID, Activity

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4624 NOT TargetLogonId="0x0" NOT Subject_User_Name=Target_User_Name (Process_Name="sqlservr.exe" OR CommandLine="*sqlcmd*") | table _time, host, Subject_User_Name, Target_User_Name, Process_Name, CommandLine, EventCode

Sigma

title: SQL Server Privilege Escalation Attempt
status: experimental
description: Detects potential privilege escalation attempts related to SQL Server processes.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    TargetLogonId: "0x0"
    SubjectUserName|!nocase: TargetUserName
    ProcessName|contains|nocase:
      - 'sqlservr.exe'
    CommandLine|contains|nocase:
      - 'sqlcmd'
  condition: selection
level: high

Elastic ES|QL

from winlog.security
| where event.code == 4624 and winlog.logon.target.id != "0x0" and winlog.logon.subject.user.name != winlog.logon.target.user.name
| where process.executable.name : "sqlservr.exe" or process.command_line : "*sqlcmd*"
| select @timestamp, host.name, winlog.logon.subject.user.name, winlog.logon.target.user.name, process.executable.name, process.command_line, event.code