CVE-2026-113862

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName =~ "svchost.exe" // NAT service runs under svchost
| where RemotePort == 53 || RemotePort == 80 || RemotePort == 443 // Common NAT-related traffic, adjust as needed
| summarize count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| where count_ > 100 // Look for unusual high volume or patterns
| project DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine

Splunk SPL

index=* (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security)
| search (EventCode=5156 OR EventCode=5158) // Network connection events
| search (ProcessName="svchost.exe" AND (dest_port=53 OR dest_port=80 OR dest_port=443))
| stats count by host, dest_ip, dest_port, ProcessName
| where count > 100

Sigma

title: Windows NAT Use After Free Anomaly
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects unusual network activity potentially related to Windows NAT service exploitation.
author: SecBoard
date: 2026/11/10
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    ProcessName|endswith: 'svchost.exe'
    DestinationPort:
      - 53
      - 80
      - 443
  condition: selection
falsepositives:
  - Legitimate network activity by NAT service
level: high

Elastic ES|QL

from network_traffic
| where process.name : "svchost.exe"
| where destination.port in (53, 80, 443)
| stats count() by host.name, destination.ip, destination.port, process.command_line
| where count > 100