CVE-2026-77481

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| summarize count() by DeviceName, FileName, InitiatingProcessCommandLine, ProcessCommandLine
| where count_ > 0

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 NewProcessName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe") ParentProcessName="sqlservr.exe"
| stats count by ComputerName, NewProcessName, CommandLine, ParentCommandLine

Sigma

title: SQL Server Spawns Shell
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious child processes spawned by SQL Server, potentially indicating a successful heap-based buffer overflow exploitation.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
  condition: selection
fields:
  - Image
  - ParentImage
  - CommandLine
  - ParentCommandLine
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.77481

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "sqlservr.exe" and process.executable in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe") | stats count() by host.name, process.executable, process.command_line, process.parent.command_line