CVE-2026-83782

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "powershell" and ProcessCommandLine contains "-e" or ProcessCommandLine contains "cmd.exe" and ProcessCommandLine contains "/c"
| where InitiatingProcessFileName =~ "explorer.exe" or InitiatingProcessFileName =~ "dllhost.exe" // Common processes for shell operations
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine
| extend Anomaly = "Potential heap-based buffer overflow exploitation in Windows Shell"

Splunk SPL

index=windows (CommandLine=*powershell* AND CommandLine=*-e*) OR (CommandLine=*cmd.exe* AND CommandLine=*/c*)
| where (ParentProcessName="explorer.exe" OR ParentProcessName="dllhost.exe")
| table _time, host, ParentProcessName, ProcessName, CommandLine, ParentCommandLine
| eval Anomaly = "Potential heap-based buffer overflow exploitation in Windows Shell"

Sigma

title: Potential Windows Shell Heap Buffer Overflow
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation patterns indicative of potential exploitation of a heap-based buffer overflow in Windows Shell.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\dllhost.exe'
  condition: selection and (powershell_encoded or cmd_command)
  powershell_encoded:
    CommandLine|contains:
      - 'powershell'
      - '-e'
  cmd_command:
    CommandLine|contains:
      - 'cmd.exe'
      - '/c'
falsepositives:
  - Legitimate administrative scripts
level: high

Elastic ES|QL

from process where
  (process.parent.executable.path : "*\\explorer.exe" or process.parent.executable.path : "*\\dllhost.exe") and
  (
    (process.args : "powershell" and process.args : "-e") or
    (process.args : "cmd.exe" and process.args : "/c")
  )
| project @timestamp, host.name, process.parent.executable.path, process.executable.path, process.command_line, process.parent.command_line
| append {
    from process where
      (process.parent.executable.path : "*\\explorer.exe" or process.parent.executable.path : "*\\dllhost.exe") and
      (process.command_line : "*powershell*" and process.command_line : "*-e*") or
      (process.command_line : "*cmd.exe*" and process.command_line : "*/c*")
    | project @timestamp, host.name, process.parent.executable.path, process.executable.path, process.command_line, process.parent.command_line
  }
| eval Anomaly = "Potential heap-based buffer overflow exploitation in Windows Shell"