CVE-2026-57185

Sentinel/Defender KQL

// Detect SIP NOTIFY requests with 'Content-Type: application/simple-message-summary' that might indicate a crafted request
// This query assumes SIP traffic is being monitored and parsed, e.g., from network device logs or a custom SIP sensor.
// Adjust 'YourLogTable' and field names to match your environment.
YourLogTable
| where Protocol == "SIP" and EventType == "NOTIFY"
| where HttpContentType contains "application/simple-message-summary"
| where isnotempty(Body) // Look for requests with a body, which is parsed by the vulnerable component
| project TimeGenerated, SourceIp, DestinationIp, UserName, SipMethod, HttpContentType, Body
| extend Anomaly = "Potential crafted SIP NOTIFY for CVE-2026-57185"
| sort by TimeGenerated desc

Splunk SPL

# Detect SIP NOTIFY requests with 'Content-Type: application/simple-message-summary' that might indicate a crafted request
# This query assumes SIP traffic is being monitored and parsed, e.g., from network device logs or a custom SIP sensor.
# Adjust 'sourcetype' and field names to match your environment.
sourcetype=your_sip_logs (sip.method="NOTIFY" OR sip_method="NOTIFY") (sip.content_type="application/simple-message-summary" OR content_type="application/simple-message-summary") sip.body=*
| table _time, src_ip, dest_ip, user, sip_method, content_type, sip_body
| rename src_ip AS SourceIp, dest_ip AS DestinationIp, user AS UserName, sip_method AS SipMethod, content_type AS HttpContentType, sip_body AS Body
| eval Anomaly = "Potential crafted SIP NOTIFY for CVE-2026-57185"

Sigma

title: Asterisk PJSIP MWI Buffer Over-read Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects SIP NOTIFY requests with 'Content-Type: application/simple-message-summary' which could indicate an attempt to exploit CVE-2026-57185.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57185
logsource:
  category: network_traffic
  product: sip_server # Or relevant network device/sensor
detection:
  selection:
    protocol: sip
    method: NOTIFY
    content_type: application/simple-message-summary
    body_exists: true # Ensure there is a body to be parsed
  condition: selection
fields:
  - source_ip
  - destination_ip
  - user
  - method
  - content_type
  - body
level: medium

Elastic ES|QL

// Detect SIP NOTIFY requests with 'Content-Type: application/simple-message-summary' that might indicate a crafted request
// This query assumes SIP traffic is being monitored and parsed, e.g., from network device logs or a custom SIP sensor.
// Adjust 'your_sip_index' and field names to match your environment.
FROM your_sip_index
WHERE sip.method == "NOTIFY" AND sip.content_type == "application/simple-message-summary" AND LENGTH(sip.body) > 0
SELECT @timestamp, source.ip, destination.ip, user.name, sip.method, sip.content_type, sip.body
ORDER BY @timestamp DESC