CVE-2026-57184

Sentinel/Defender KQL

let H323Ports = dynamic([1720]);
NetworkCommunicationEvents
| where RemotePort in (H323Ports) or LocalPort in (H323Ports)
| where Protocol == "tcp"
| where ApplicationProtocol == "h323"
| where isnotempty(Payload)
| where Payload contains "Q.931" and Payload contains "setup packets"
| summarize count() by DeviceName, RemoteIP, RemotePort, LocalIP, LocalPort

Splunk SPL

index=* (dest_port=1720 OR src_port=1720) protocol=tcp app_protocol=h323 | search Q.931 AND "setup packets" | stats count by host, src_ip, src_port, dest_ip, dest_port

Sigma

title: Asterisk H.323 Q.931 Out-of-Bounds Read Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to exploit CVE-2026-57184 in Asterisk via crafted H.323 Q.931 setup packets.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57184
author: SecBoard
date: 2024/07/30
modified: 2024/07/30
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.57184
logsource:
  category: network_traffic
  product: asterisk
detection:
  selection:
    dest_port: 1720
    protocol: tcp
    payload|contains_all:
      - 'Q.931'
      - 'setup packets'
  condition: selection
falsepositives:
  - Legitimate H.323 traffic that coincidentally matches payload patterns.
level: high

Elastic ES|QL

from network_traffic
| where destination.port == 1720 or source.port == 1720
| where network.transport == "tcp"
| where network.protocol == "h323"
| where message : "Q.931" and message : "setup packets"
| stats count() by host.name, source.ip, source.port, destination.ip, destination.port