CVE-2026-109468

Sentinel/Defender KQL

// This query attempts to detect unusual resource consumption that could indicate a DoS attack related to CVE-2026-109468.
// It looks for processes that consume high CPU or memory over a sustained period, which might be indicative of a resource exhaustion attack.
// This is a generic behavioral detection and needs tuning for specific ASP.NET Core applications.
ProcessPerformance
| where bin(Timestamp, 5m) > ago(1h) // Adjust time window as needed
| summarize AvgCpu = avg(CPU), MaxCpu = max(CPU), AvgMemory = avg(WorkingSetBytes)
    by bin(Timestamp, 5m), DeviceName, ProcessName
| where AvgCpu > 80 or MaxCpu > 95 or AvgMemory > 1000000000 // Example thresholds: 80% avg CPU, 95% max CPU, 1GB avg memory
| project Timestamp, DeviceName, ProcessName, AvgCpu, MaxCpu, AvgMemory
| order by Timestamp desc

Splunk SPL

# This query attempts to detect unusual resource consumption that could indicate a DoS attack related to CVE-2026-109468.
# It looks for processes that consume high CPU or memory over a sustained period, which might be indicative of a resource exhaustion attack.
# This is a generic behavioral detection and needs tuning for specific ASP.NET Core applications.
index=perfmon sourcetype=Perfmon:CPU OR sourcetype=Perfmon:Memory
| timechart span=5m avg(Value) as avg_value by host, counter
| where counter="% Processor Time" AND avg_value > 80 OR counter="Working Set" AND avg_value > 1000000000
| rename avg_value as resource_consumption
| table _time, host, counter, resource_consumption
| sort -_time

Sigma

title: ASP.NET Core Resource Exhaustion DoS Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects potential Denial of Service attempts against ASP.NET Core applications by monitoring for unusual and sustained high resource consumption.
author: SecBoard
date: 2026/10/16
logsource:
  category: process_monitoring
  product: windows
detection:
  selection:
    EventID: 3 # Example for process performance monitoring, adjust based on actual logs
    Image|endswith: 
      - '\dotnet.exe'
      - '\iisexpress.exe'
      - '\w3wp.exe'
  condition: selection | stats avg(CpuUsage) as avg_cpu, max(CpuUsage) as max_cpu, avg(MemoryUsage) as avg_memory by Image, Hostname | where avg_cpu > 80 or max_cpu > 95 or avg_memory > 1000000000
falsepositives:
  - Legitimate high load periods
  - Other resource-intensive applications
level: high

Elastic ES|QL

// This query attempts to detect unusual resource consumption that could indicate a DoS attack related to CVE-2026-109468.
// It looks for processes that consume high CPU or memory over a sustained period, which might be indicative of a resource exhaustion attack.
// This is a generic behavioral detection and needs tuning for specific ASP.NET Core applications.
from system.process.summary
| where timestamp > now() - INTERVAL 1h
| summarize avg_cpu = avg(cpu.total.pct), max_cpu = max(cpu.total.pct), avg_memory = avg(memory.rss.bytes)
    by host.name, process.name
| where avg_cpu > 0.80 or max_cpu > 0.95 or avg_memory > 1000000000 // Example thresholds: 80% avg CPU, 95% max CPU, 1GB avg memory
| project timestamp, host.name, process.name, avg_cpu, max_cpu, avg_memory
| sort by timestamp desc