---
title: Potential Exploitation of CVE-2026-21881 Excel RCE
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of the Excel legacy parser flaw by monitoring for unusual child processes spawned by Excel.
references:
  - https://thehackernews.com/2026/04/threatsday-bulletin-17-year-old-excel.html
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\EXCEL.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_legit:
    CommandLine|contains: 'C:\Program Files\Microsoft Office\'
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Legitimate administrative scripts launched via Excel macros (rare)
level: high
---
title: Microsoft Defender Kernel Driver Tamper Attempt (CVE-2026-21882)
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects attempts to interact directly with the Microsoft Defender kernel driver handles, often indicative of LPE exploit preparation.
references:
  - https://thehackernews.com/2026/04/threatsday-bulletin-17-year-old-excel.html
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|contains: 'WdFilter.sys'
    GrantedAccess|contains: '0x1F0FFF'
  filter:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\NisSrv.exe'
      - '\svchost.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate antivirus self-scanning operations
level: critical
---
title: SonicWall SSL-VPN Brute Force Activity
id: c3d4e5f6-7890-12bc-def0-3456789012cd
status: experimental
description: Detects high volume of authentication failures on SonicWall SSL-VPN interfaces indicating a brute force campaign.
references:
  - https://thehackernews.com/2026/04/threatsday-bulletin-17-year-old-excel.html
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1110.001
logsource:
  category: firewall
  product: sonicwall
detection:
  selection:
    DeviceVendor: 'SonicWall'
    Activity|contains: 'Login failed'
    DestinationPort: 443
  timeframe: 1m
  condition: selection | count() > 10
falsepositives:
  - Legitimate users forgetting passwords during peak hours
level: medium

// Hunt for Excel spawning suspicious child processes (CVE-2026-21881)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| extend FileHash = SHA256
| join kind=leftouter (DeviceFileEvents | project SHA256, GlobalPrevalence) on FileHash
| where isnull(GlobalPrevalence) or GlobalPrevalence < 50
| sort by Timestamp desc


// Hunt for SonicWall Brute Force via Syslog/CEF ingestion
Syslog
| where TimeGenerated > ago(12h)
| where Facility contains "SonicWall"
| where SyslogMessage has "Login failed" or SyslogMessage has "Authentication failed"
| parse SyslogMessage with * "src=" SourceIP ":" * "user=" User *
| summarize count() by bin(TimeGenerated, 5m), SourceIP, User
| where count_ > 5
| project TimeGenerated, SourceIP, User, FailedAttempts = count_
| sort by FailedAttempts desc

-- Hunt for Excel versions vulnerable to CVE-2026-21881
SELECT 
  OSPath, 
  Mtime, 
  VersionInfo.ProductVersion,
  VersionInfo.FileVersion
FROM glob(globs='*/EXCEL.EXE')
WHERE VersionInfo.ProductVersion < '16.0.18000' 
   OR VersionInfo.ProductVersion =~ '15.*'
   OR VersionInfo.ProductVersion =~ '14.*'
   OR VersionInfo.ProductVersion =~ '12.*'

-- Hunt for suspicious handles to WdFilter.sys (CVE-2026-21882)
SELECT Pid, Name, CommandLine, Handles.Handle, Handles.ObjectName
FROM handles()
WHERE Name =~ "EXCEL.EXE" OR Name =~ "winword.exe"
  AND Handles.ObjectName =~ "WdFilter.sys"

<#
.SYNOPSIS
Check and Remediate CVE-2026-21881 (Excel) and CVE-2026-21882 (Defender)
.DESCRIPTION

Write-Host "[+] Checking Microsoft Excel Version for CVE-2026-21881..."

    Write-Host "    Current Excel Version: $FileVer"

$IsVulnerable = $true
foreach ($safe in $SafeBuilds) {
    if ($FileVer -ge $safe) { 
        $IsVulnerable = $false 
        break 
    }
}

if ($IsVulnerable) {

        Write-Host "    [ALERT] Excel is vulnerable to CVE-2026-21881. Please update Office immediately." -ForegroundColor Red

} else {

        Write-Host "    [OK] Excel version is patched." -ForegroundColor Green

}

    Write-Host "    [WARN] Excel not found in standard paths." -ForegroundColor Yellow

Write-Host "[+] Verifying Microsoft Defender Driver Version for CVE-2026-21882..."

    Write-Host "    Current WdFilter.sys Version: $DriverVer"

# Check for patched driver version (Hypothetical)
if ($DriverVer -lt "4.18.24010.5") {

        Write-Host "    [ALERT] WdFilter.sys is vulnerable to CVE-2026-21882. Update Windows OS immediately." -ForegroundColor Red

} else {

        Write-Host "    [OK] WdFilter.sys is patched." -ForegroundColor Green

}