CVE-2026-83910

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "rpcss.exe"
| where FileName !in ("svchost.exe", "conhost.exe") // Legitimate child processes
| where ProcessCommandLine has_any ("powershell", "cmd.exe", "mshta.exe", "rundll32.exe") or RemoteIP != "" // Suspicious commands or network connections
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessParentFileName

Splunk SPL

index=windows_events (ParentProcessName="rpcss.exe" NOT ProcessName IN ("svchost.exe", "conhost.exe")) (CommandLine=*powershell* OR CommandLine=*cmd.exe* OR CommandLine=*mshta.exe* OR CommandLine=*rundll32.exe* OR dest_ip!=NULL) | table _time, host, ParentProcessName, ProcessName, CommandLine, dest_ip, dest_port

Sigma

title: RPC Runtime Out-of-Bounds Write Exploitation
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation or network activity originating from the RPC Runtime process, indicative of successful exploitation of CVE-2026-83910.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\rpcss.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter:
    Image|endswith:
      - '\svchost.exe'
      - '\conhost.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate RPC Runtime child processes (filtered)
level: critical

Elastic ES|QL

from process where
  process.parent.executable : "rpcss.exe" and
  not process.executable : ("svchost.exe", "conhost.exe") and
  (process.command_line : ("*powershell*", "*cmd.exe*", "*mshta.exe*", "*rundll32.exe*") or network.direction : "outbound")
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, destination.ip, destination.port