CVE-2026-96951

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("outlook.exe", "chrome.exe", "msedge.exe", "firefox.exe")
| where FileName has_any (".exe", ".dll", ".js", ".vbs", ".ps1", ".hta")
| where FolderPath contains "Downloads" or FolderPath contains "Temp"
| where not (InitiatingProcessCommandLine contains "--disable-features=MarkOfTheWeb") // Example for browser-specific bypasses
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine, SHA256

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=WinEventLog:Security EventCode=4688)
| where (ParentImage="*\\outlook.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\firefox.exe")
| where (Image LIKE "%.exe" OR Image LIKE "%.dll" OR Image LIKE "%.js" OR Image LIKE "%.vbs" OR Image LIKE "%.ps1" OR Image LIKE "%.hta")
| where (Image CONTAINS "\\Downloads\\" OR Image CONTAINS "\\Temp\\")
| where NOT (CommandLine CONTAINS "--disable-features=MarkOfTheWeb")
| table _time, Hostname, ParentImage, Image, CommandLine, ParentCommandLine, Hashes

Sigma

title: Windows Shell MotW Bypass Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential attempts to bypass Mark-of-the-Web (MotW) security features in Windows Shell.
references:
  - https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.js'
      - '.vbs'
      - '.ps1'
      - '.hta'
    Image|contains:
      - '\Downloads\'
      - '\Temp\'
  filter_legitimate:
    CommandLine|contains: '--disable-features=MarkOfTheWeb' # Example for browser-specific bypasses, adjust as needed
  condition: selection and not filter_legitimate
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
level: high

Elastic ES|QL

from process where event.type == "start" and
  (process.parent.executable : ("outlook.exe", "chrome.exe", "msedge.exe", "firefox.exe")) and
  (process.executable : ("*.exe", "*.dll", "*.js", "*.vbs", "*.ps1", "*.hta")) and
  (process.args : ("*\\Downloads\\*", "*\\Temp\\*")) and
  not (process.args : ("*--disable-features=MarkOfTheWeb*"))
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.parent.command_line, process.hash.sha256