CVE-2026-70181

Sentinel/Defender KQL

let threshold = 1000; // Define a threshold for unusual resource allocation
AppRequests
| where AppName contains "ASP.NET Core"
| summarize RequestCount = count() by bin(timestamp, 5m), ClientIP
| where RequestCount > threshold
| project timestamp, ClientIP, RequestCount, "Potential DoS - High Request Count"
| extend Description = "Potential Denial of Service attempt due to unusual resource allocation in ASP.NET Core."

Splunk SPL

sourcetype="asp.net:core:logs" | stats count as RequestCount by _time, client_ip | where RequestCount > 1000 | table _time, client_ip, RequestCount | rename client_ip as ClientIP | eval Description="Potential Denial of Service attempt due to unusual resource allocation in ASP.NET Core."

Sigma

title: ASP.NET Core DoS via Resource Allocation
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential Denial of Service attempts by monitoring unusual resource allocation patterns in ASP.NET Core applications.
author: SecBoard
date: 2026/10/14
logsource:
  product: asp.net
  service: core
detection:
  selection:
    EventID: 'ResourceAllocation'
    Message|contains: 'ASP.NET Core'
  timeframe: 5m
  condition: selection | stats count() by SourceIp | where count() > 1000
falsepositives:
  - Legitimate high traffic
level: high

Elastic ES|QL

FROM logs-aspnet.core-*
| WHERE event.code : "ResourceAllocation"
| WHERE message : "ASP.NET Core"
| SUM count() AS request_count BY @timestamp, source.ip
| WHERE request_count > 1000
| SELECT @timestamp, source.ip, request_count, "Potential DoS - High Request Count" AS description