CVE-2026-81963

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("wuauclt.exe", "svchost.exe")
| where ProcessCommandLine contains "/updatenow" or ProcessCommandLine contains "/install"
| where InitiatingProcessFileName !in~ ("svchost.exe", "explorer.exe") // Legitimate update processes
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

(sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security) (EventCode=4688 OR EventCode=1) (New_Process_Name=*wuauclt.exe* OR New_Process_Name=*svchost.exe*) (CommandLine=*updatenow* OR CommandLine=*install*) NOT (Parent_Process_Name=*svchost.exe* OR Parent_Process_Name=*explorer.exe*) | table _time, host, Parent_Process_Name, CommandLine, New_Process_Name, Process_Command_Line, Process_Path, Process_Hash

Sigma

title: Windows Update Stack Privilege Escalation Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential privilege escalation attempts leveraging improper link resolution in the Windows Update Stack.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wuauclt.exe'
      - '\svchost.exe'
    CommandLine|contains:
      - '/updatenow'
      - '/install'
  filter:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
  condition: selection and not filter
level: high

Elastic ES|QL

from process where process.executable in ("wuauclt.exe", "svchost.exe") and (process.args contains "/updatenow" or process.args contains "/install") and not (process.parent.executable in ("svchost.exe", "explorer.exe")) | project @timestamp, host.name, process.parent.executable, process.parent.args, process.executable, process.args, process.working_directory, process.hash.sha256