Microsoft Windows Command Injection (CVE-2026-96951)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("svchost.exe", "services.exe", "spoolsv.exe", "w3wp.exe", "wsmprovhost.exe", "explorer.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("&", "|", ";", "&&", "||", "`", "$(", "%0a", "\n")
| where ProcessCommandLine has_any ("whoami", "net ", "certutil", "bitsadmin", "curl ", "Invoke-WebRequest", "-enc", "FromBase64String", "rundll32", "regsvr32")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, ProcessId, InitiatingProcessCommandLine
| order by Timestamp desc

index=windows (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR sourcetype="XmlWinEventLog:Security" EventCode=4688
| eval proc=lower(coalesce(Image, New_Process_Name))
| eval parent=lower(coalesce(ParentImage, Creator_Process_Name))
| eval cmd=coalesce(CommandLine, Process_Command_Line)
| where like(proc, "%cmd.exe") OR like(proc, "%powershell.exe") OR like(proc, "%pwsh.exe") OR like(proc, "%wscript.exe") OR like(proc, "%cscript.exe")
| where like(parent, "%svchost.exe") OR like(parent, "%spoolsv.exe") OR like(parent, "%w3wp.exe") OR like(parent, "%wsmprovhost.exe") OR like(parent, "%services.exe")
| regex cmd="[&|;`]|&&|\|\||\$\(|%0a"
| regex cmd="(?i)(whoami|net\s|certutil|bitsadmin|curl\s|Invoke-WebRequest|-enc|FromBase64String|rundll32|regsvr32)"
| table _time, host, user, parent, proc, cmd
| sort - _time

process where event.type == "start" and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe") and
  process.parent.name : ("svchost.exe", "spoolsv.exe", "w3wp.exe", "wsmprovhost.exe", "services.exe") and
  process.command_line : ("*&*", "*|*", "*;*", "*`*", "*$(*", "*%0a*") and
  process.command_line : ("*whoami*", "*net *", "*certutil*", "*bitsadmin*", "*curl *", "*Invoke-WebRequest*", "*-enc*", "*FromBase64String*", "*rundll32*", "*regsvr32*")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmd, sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Microsoft Sysmon') AND (LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe' OR LOWER("Process Name") LIKE '%wscript.exe' OR LOWER("Process Name") LIKE '%cscript.exe') AND (LOWER("Parent Process Name") LIKE '%svchost.exe' OR LOWER("Parent Process Name") LIKE '%spoolsv.exe' OR LOWER("Parent Process Name") LIKE '%w3wp.exe' OR LOWER("Parent Process Name") LIKE '%wsmprovhost.exe') AND ("Command Line" IMATCHES '.*([&|;`]|&&|\|\||\$\(|%0a).*') AND ("Command Line" IMATCHES '.*(whoami|certutil|bitsadmin|curl|Invoke-WebRequest|-enc|FromBase64String|rundll32|regsvr32).*') ORDER BY starttime DESC LAST 7 DAYS

_sourceCategory=*windows* ("cmd.exe" OR "powershell.exe" OR "pwsh.exe" OR "wscript.exe" OR "cscript.exe")
| parse "NewProcessName=*\"" as process nodrop
| parse "ParentProcessName=*\"" as parent nodrop
| parse "CommandLine=*\"" as cmd nodrop
| where (toLowerCase(parent) matches "*svchost.exe" or toLowerCase(parent) matches "*spoolsv.exe" or toLowerCase(parent) matches "*w3wp.exe" or toLowerCase(parent) matches "*wsmprovhost.exe")
| where cmd matches /[&|;`]|&&|\|\||\$\(|%0a/
| where cmd matches /(?i)(whoami|certutil|bitsadmin|curl|Invoke-WebRequest|-enc|FromBase64String|rundll32|regsvr32)/
| fields _messageTime, host, parent, process, cmd
| sort by _messageTime desc

rule cve_2026_96951_windows_command_injection {
  meta:
    author = "argus"
    description = "Windows command injection exploitation (CVE-2026-96951)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.target.process.file.full_path, `(?i)\\(cmd|powershell|pwsh|wscript|cscript)\.exe$`)
    re.regex($e.principal.process.file.full_path, `(?i)\\(svchost|spoolsv|w3wp|wsmprovhost|services)\.exe$`)
    re.regex($e.target.process.command_line, `[&|;` + "`" + `]|&&|\|\||\$\(|%0a`)
    re.regex($e.target.process.command_line, `(?i)(whoami|certutil|bitsadmin|curl|Invoke-WebRequest|-enc|FromBase64String|rundll32|regsvr32)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| in(field="ImageFileName", values=["*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\wscript.exe", "*\\cscript.exe"])
| in(field="ParentBaseFileName", values=["svchost.exe", "spoolsv.exe", "w3wp.exe", "wsmprovhost.exe", "services.exe"])
| CommandLine=/[&|;`]|&&|\|\||\$\(|%0a/
| CommandLine=/(?i)(whoami|certutil|bitsadmin|curl|Invoke-WebRequest|-enc|FromBase64String|rundll32|regsvr32)/
| table([_time, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])
| sort(_time, order=desc)