CVE-2026-58280

Sentinel/Defender KQL

let threshold = 1000; // Adjust based on normal traffic
NetworkConnectionEvents
| where InitiatingProcessFileName endswith ".exe" or InitiatingProcessFileName endswith ".dll"
| where InitiatingProcessFileName has ".NET"
| summarize ConnectionCount = count() by bin(TimeGenerated, 5m), RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount > threshold
| extend Description = "Potential DoS via uncontrolled recursion in .NET"

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3 OR EventCode=1
| where Image="*.exe" OR Image="*.dll"
| where Image LIKE "%.NET%"
| stats count as ConnectionCount by _time, Dest_IP, Dest_Port, Image
| where ConnectionCount > 1000
| eval Description = "Potential DoS via uncontrolled recursion in .NET"

Sigma

title: .NET Uncontrolled Recursion DoS Attempt
id: 9a8b7c6d-5e4f-3a2b-1c0d-e9f8a7b6c5d4
status: experimental
description: Detects potential Denial of Service attempts targeting .NET applications via uncontrolled recursion by monitoring for an unusually high rate of network connections.
author: SecBoard
date: 2026/10/14
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: ['.exe', '.dll']
    Image|contains: '.NET'
  timeframe: 5m
  condition: selection | stats count() by SourceIp, DestinationIp, DestinationPort, Image | where count() > 1000
  level: high

Elastic ES|QL

from network where process.executable.extension in ("exe", "dll") and process.executable.text_content like "%.NET%"
| summarize connection_count = count() by 5m, destination.ip, destination.port, process.executable.name
| where connection_count > 1000
| set description = "Potential DoS via uncontrolled recursion in .NET"