CVE-2026-97741

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "excel.exe"
| where ProcessCommandLine contains "/c" or ProcessCommandLine contains "powershell" or ProcessCommandLine contains "cmd.exe"
| where FileName !~ "excel.exe"

Splunk SPL

index=your_index sourcetype=your_sourcetype
| where InitiatingProcessFileName="excel.exe"
| where match(ProcessCommandLine, ".*(\/c|powershell|cmd.exe).*")
| where FileName!="excel.exe"

Sigma

title: Excel Child Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\excel.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection

Elastic ES|QL

from process where event.type == "start" and process.parent.executable : "excel.exe" and process.executable : ("cmd.exe", "powershell.exe", "pwsh.exe")