CVE-2026-96236

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "dotnet" or FileName contains "iisexpress"
| join kind=inner (DeviceNetworkEvents
    | where InitiatingProcessFileName contains "dotnet" or InitiatingProcessFileName contains "iisexpress"
    | summarize TotalBytesSent = sum(SentBytes), TotalBytesReceived = sum(ReceivedBytes) by DeviceId, InitiatingProcessFileName
    | where TotalBytesSent > 100000000 or TotalBytesReceived > 100000000 // Beispiel: 100MB Schwellenwert
) on DeviceId, $left.FileName == $right.InitiatingProcessFileName
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, TotalBytesSent, TotalBytesReceived, RemoteIP, RemotePort
| extend Anomaly = "High resource usage potentially indicating DoS attempt"

Splunk SPL

(sourcetype=perfmon:cpu OR sourcetype=perfmon:memory OR sourcetype=perfmon:network) (process_name=*dotnet* OR process_name=*iisexpress*)
| eval cpu_usage = case(metric_name="% Processor Time", Value, 1=1, null)
| eval memory_usage = case(metric_name="Working Set", Value, 1=1, null)
| eval network_bytes = case(metric_name="Bytes Total/sec", Value, 1=1, null)
| stats avg(cpu_usage) as avg_cpu, avg(memory_usage) as avg_memory, avg(network_bytes) as avg_network_bytes by host, process_name
| where avg_cpu > 80 OR avg_memory > 8000000000 OR avg_network_bytes > 100000000 // Beispiel: 80% CPU, 8GB RAM, 100MB/s Netzwerk
| table host, process_name, avg_cpu, avg_memory, avg_network_bytes

Sigma

title: ASP.NET Core DoS via Resource Exhaustion
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential Denial of Service attempts against ASP.NET Core applications due to uncontrolled resource allocation.
author: SecBoard
date: 2026/10/14
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\dotnet.exe'
      - '\iisexpress.exe'
  filter_high_cpu:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\services.exe'
  condition: selection and not filter_high_cpu
falsepositives:
  - Legitimate high load on ASP.NET Core applications
level: high

Elastic ES|QL

from process where process.name in ("dotnet.exe", "iisexpress.exe")
| join (from network where process.name in ("dotnet.exe", "iisexpress.exe")
    | summarize total_bytes_sent = sum(network.bytes_written), total_bytes_received = sum(network.bytes_read) by host.name, process.name
    | where total_bytes_sent > 100000000 or total_bytes_received > 100000000
) on host.name, process.name
| select @timestamp, host.name, process.name, total_bytes_sent, total_bytes_received
| append { from host.metrics() where host.name in (select host.name from process where process.name in ("dotnet.exe", "iisexpress.exe"))
    | summarize avg_cpu = avg(host.cpu.usage), avg_memory = avg(host.memory.usage) by host.name
    | where avg_cpu > 80 or avg_memory > 0.8 // Beispiel: 80% CPU, 80% Speicher
    | select @timestamp, host.name, avg_cpu, avg_memory
}