CVE-2026-66073

Sentinel/Defender KQL

let timeframe = 1h;
let threshold = 100;
HttpEvents
| where Url contains "/api/queues/" or Url contains "/api/exchanges/" or Url contains "/api/bindings/"
| where RequestMethod == "PUT"
| summarize distinct_node_values = dcount(tostring(parse_json(RequestBody).node)), request_count = count() by bin(TimeGenerated, 5m), SourceIp, DestinationIp, Url
| where distinct_node_values > threshold
| project TimeGenerated, SourceIp, DestinationIp, Url, distinct_node_values, request_count
| order by TimeGenerated desc

Splunk SPL

index=* (uri_path="/api/queues/*" OR uri_path="/api/exchanges/*" OR uri_path="/api/bindings/*") method="PUT"
| spath input=request_body path=node output=node_field
| stats dc(node_field) as distinct_node_values, count as request_count by _time, clientip, dest_ip, uri_path
| where distinct_node_values > 100
| sort -_time

Sigma

title: RabbitMQ Atom Table Exhaustion Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential attempts to exhaust the RabbitMQ atom table via repeated management API calls with unique node field values.
author: SecBoard
date: 2026/07/09
logsource:
  product: rabbitmq
  service: management_api
detection:
  selection:
    http.method: "PUT"
    http.url|contains:
      - "/api/queues/"
      - "/api/exchanges/"
      - "/api/bindings/"
  timeframe: 1h
  condition: selection | stats count() as request_count, distinct_count(http.request_body.node) as distinct_node_values by http.source_ip, http.url | where distinct_node_values > 100
  level: medium

Elastic ES|QL

FROM logs
| WHERE http.method == "PUT"
| WHERE http.url.path : "/api/queues/*" OR http.url.path : "/api/exchanges/*" OR http.url.path : "/api/bindings/*"
| EVAL node_field = json_field(http.request.body.content, 'node')
| SUM request_count = count(), distinct_node_values = distinct_count(node_field) BY client.ip, http.url.path, @timestamp
| WHERE distinct_node_values > 100
| SORT @timestamp DESC