CVE-2026-69651

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName endswith ".exe" or FileName endswith ".dll"
| where ProcessCommandLine contains ".net"
| summarize (TotalCPU, TotalMemory) = (sum(ProcessPerformance.CPU), sum(ProcessPerformance.Memory)), ProcessCount = dcount(ProcessId) by DeviceName, FileName
| where TotalCPU > 80 or TotalMemory > 8000000000 // Adjust thresholds as needed (e.g., 80% CPU, 8GB Memory)
| project DeviceName, FileName, TotalCPU, TotalMemory, ProcessCount
| order by TotalCPU desc

Splunk SPL

index=* (sourcetype=Perfmon:CPU or sourcetype=Perfmon:Memory) host=* process_name="*.exe" OR process_name="*.dll" | where process_name LIKE "%.net%" | stats sum(CPU_Usage) as TotalCPU, sum(Memory_Usage) as TotalMemory, dc(process_id) as ProcessCount by host, process_name | where TotalCPU > 80 OR TotalMemory > 8000000000 | table host, process_name, TotalCPU, TotalMemory, ProcessCount | sort -TotalCPU

Sigma

title: .NET DoS - Inefficient Algorithmic Complexity
status: experimental
description: Detects potential Denial of Service attacks against .NET applications due to inefficient algorithmic complexity by monitoring unusual resource consumption.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69651
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains: '.net'
  condition: selection
  timeframe: 5m
  level: high
falsepositives:
  - Legitimate high resource usage applications
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine

Elastic ES|QL

from process where process.executable.extension in ("exe", "dll") and process.args like "*.net*"
| stats sum(process.cpu.usage) as total_cpu, sum(process.memory.usage) as total_memory, count(distinct process.pid) as process_count by host.name, process.executable.name
| where total_cpu > 80 or total_memory > 8000000000
| sort by total_cpu desc