CVE-2026-76465

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "cli" and ProcessCommandLine contains "feature mpls_oam"
| where InitiatingProcessCommandLine !contains "show feature"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
// Further behavioral detection for crafted MPLS echo-request packets would require network flow or deep packet inspection logs, looking for malformed or excessive MPLS echo-request traffic targeting affected Cisco Nexus devices.
// Example (conceptual, requires specific network device logs):
// NetworkFlow_CL
// | where DstIP in ("<Affected_Nexus_IPs>")
// | where Protocol == "MPLS" and DstPort == "<MPLS_OAM_Port_if_applicable>" // MPLS OAM typically uses UDP 3503 for echo-reply, echo-request might be raw MPLS or encapsulated.
// | where PacketLength > <unusually_large_or_malformed_size> // Placeholder for detecting crafted packets
// | summarize count() by bin(Timestamp, 1h), DstIP, SrcIP
// | where count_ > <threshold>

Splunk SPL

index=* (sourcetype=cisco:nxos OR sourcetype=syslog)
| regex "feature mpls_oam" AND NOT "show feature"
| table _time, host, source, _raw

# Further behavioral detection for crafted MPLS echo-request packets would require network flow or deep packet inspection logs, looking for malformed or excessive MPLS echo-request traffic targeting affected Cisco Nexus devices.
# Example (conceptual, requires specific network device logs):
# index=network_flow DstIP IN ("<Affected_Nexus_IPs>") Protocol="MPLS" DstPort="<MPLS_OAM_Port_if_applicable>" PacketLength><unusually_large_or_malformed_size>
# | timechart count by DstIP, SrcIP

Sigma

title: Cisco NX-OS MPLS OAM Feature Enablement
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to enable the MPLS OAM feature on Cisco NX-OS, which is a prerequisite for CVE-2026-76465 exploitation.
author: SecBoard
date: 2026/10/07
logsource:
  product: cisco
  service: nxos
detection:
  selection:
    event_simpleName: ProcessCommandLine
    CommandLine|contains: 'feature mpls_oam'
    CommandLine|not_contains: 'show feature'
  condition: selection
fields:
  - CommandLine
  - Hostname
level: high

---

title: Cisco NX-OS MPLS OAM Malformed Echo-Request (Conceptual)
id: 00000000-0000-0000-0000-000000000002
status: experimental
description: Conceptual detection for crafted MPLS echo-request packets targeting Cisco Nexus switches. Requires network flow or deep packet inspection logs.
author: SecBoard
date: 2026/10/07
logsource:
  product: network
  service: flow
detection:
  selection:
    DestinationIp|startswith: '<Affected_Nexus_IP_Prefix>'
    Protocol: 'MPLS'
    # Add conditions for malformed or unusually large packets if available in logs
  condition: selection
fields:
  - SourceIp
  - DestinationIp
  - Protocol
level: critical

Elastic ES|QL

FROM logs-cisco.nxos.*
| WHERE message : "feature mpls_oam" AND NOT message : "show feature"
| SELECT @timestamp, host.name, message

// Further behavioral detection for crafted MPLS echo-request packets would require network flow or deep packet inspection logs, looking for malformed or excessive MPLS echo-request traffic targeting affected Cisco Nexus devices.
// Example (conceptual, requires specific network device logs):
// FROM network_flow_logs
// | WHERE destination.ip IN ("<Affected_Nexus_IPs>") AND network.transport == "mpls" AND event.dataset == "mpls_oam_traffic" AND network.bytes > <unusually_large_or_malformed_size>
// | SUM by @timestamp, destination.ip, source.ip