Splunk CVE-2026-20253 RCE - Unexpected Child Process Spawned by splunkd
Detects remote code execution exploitation targeting CVE-2026-20253 in Splunk. The rule monitors for unauthorized child processes, such as shells or scripting interpreters, being spawned by the Splunk daemon (splunkd). It also flags processes containing exploit-related strings in the command line as a secondary indicator.
Microsoft Sentinel (KQL)
