CVE-2026-57186

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName contains "asterisk"
| where RemotePort == "H.323 port" // Standard H.323 port is 1720 TCP, but may vary
| where NetworkProtocol == "Tcp"
| where ActionType == "ConnectionAttempt"
| summarize ConnectionCount = count() by RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount > "threshold for malformed requests" // Define a threshold for unusual connection attempts

Splunk SPL

sourcetype="your_asterisk_logs" "Error:Calling party number outside range" OR "Error:Calling party number too long" OR "Q931" OR "chan_ooh323"
| stats count by host, source, _time
| where count > "threshold for malformed requests"

Sigma

title: Asterisk OOH323 Malformed Q.931 Detection
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - 'Error:Calling party number outside range'
    - 'Error:Calling party number too long'
    - 'Q931'
    - 'chan_ooh323'
  condition: keywords
level: high

Elastic ES|QL

from logs-asterisk-*
| where message : "Error:Calling party number outside range" or message : "Error:Calling party number too long" or message : "Q931" or message : "chan_ooh323"
| stats count() by host.name, @timestamp
| where count > "threshold for malformed requests"