CVE-2026-97742

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where FileName !~ "EXCEL.EXE" and FileName !~ "cmd.exe" and FileName !~ "powershell.exe" // Exclude common Excel child processes
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c" or ProcessCommandLine contains "-e" // Look for command execution patterns
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

index=your_windows_logs sourcetype=your_process_creation_logs (ParentProcessName="EXCEL.EXE" OR ParentProcessName="excel.exe") NOT (ProcessName="EXCEL.EXE" OR ProcessName="excel.exe" OR ProcessName="cmd.exe" OR ProcessName="powershell.exe") (CommandLine="-c" OR CommandLine="/c" OR CommandLine="-e") | table _time, host, ParentProcessName, ProcessName, CommandLine, Image, Hashes

Sigma

title: Excel Stack-based Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of a stack-based buffer overflow in Microsoft Excel by monitoring unusual child process creation.
author: SecBoard
date: 2026/10/13
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\EXCEL.EXE'
    Image|endswith: 
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-c'
      - '/c'
      - '-e'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2026.97742
  - car.2013-05-003

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "EXCEL.EXE" and process.executable != "EXCEL.EXE" and process.executable != "cmd.exe" and process.executable != "powershell.exe" and (process.args : ("-c", "/c", "-e")) | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.hash.sha256