CVE-2026-96958

Sentinel/Defender KQL

let Timeframe = 1h;
DeviceNetworkEvents
| where Timestamp > ago(Timeframe)
| where InitiatingProcessFileName has_any (".net", "dotnet")
| summarize RequestCount = count(), TotalBytesSent = sum(SentBytes), TotalBytesReceived = sum(ReceivedBytes) by DeviceId, RemoteIP, RemotePort
| where RequestCount > 1000 or TotalBytesSent > 100000000 or TotalBytesReceived > 100000000 // Adjust thresholds as needed
| project DeviceId, RemoteIP, RemotePort, RequestCount, TotalBytesSent, TotalBytesReceived
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(Timeframe)
    | where FileName has_any (".net", "dotnet")
    | summarize arg_max(Timestamp, *) by ProcessId
    | project ProcessId, DeviceId, FileName, ProcessCommandLine
) on DeviceId
| extend AlertReason = "Potential DoS attempt against .NET application"
| project-reorder AlertReason, DeviceId, FileName, ProcessCommandLine, RemoteIP, RemotePort, RequestCount, TotalBytesSent, TotalBytesReceived

Splunk SPL

sourcetype=ms:aad:signin OR sourcetype=ms:defender:atp:network OR sourcetype=ms:defender:atp:process
| where _time > -1h
| eval process_name = lower(coalesce(ProcessName, InitiatingProcessFileName))
| where process_name like "%.net%" OR process_name like "%dotnet%"
| stats count as RequestCount, sum(SentBytes) as TotalBytesSent, sum(ReceivedBytes) as TotalBytesReceived by host, dest_ip, dest_port
| where RequestCount > 1000 OR TotalBytesSent > 100000000 OR TotalBytesReceived > 100000000
| `security_content_ctime(TotalBytesSent)`
| `security_content_ctime(TotalBytesReceived)`
| `security_content_ctime(RequestCount)`
| table host, dest_ip, dest_port, RequestCount, TotalBytesSent, TotalBytesReceived
| rename host as DeviceId, dest_ip as RemoteIP, dest_port as RemotePort
| eval AlertReason = "Potential DoS attempt against .NET application"

Sigma

title: .NET DoS Vulnerability Detection
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects potential Denial of Service attempts targeting .NET applications based on unusual network traffic or resource consumption.
author: SecBoard
date: 2026/10/14
logsource:
  category: network_connection
  product: windows
  service: mde
detection:
  selection:
    InitiatingProcessFileName|endswith:
      - '.net.exe'
      - 'dotnet.exe'
    InitiatingProcessFileName|contains:
      - 'iisexpress.exe'
      - 'w3wp.exe'
  condition: selection | stats count() as request_count, sum(SentBytes) as total_sent_bytes, sum(ReceivedBytes) as total_received_bytes by InitiatingProcessFileName, DestinationIp, DestinationPort | where request_count > 1000 or total_sent_bytes > 100000000 or total_received_bytes > 100000000
falsepositives:
  - Legitimate high traffic to .NET applications
level: high

Elastic ES|QL

from network_traffic
| where timestamp > now() - INTERVAL 1 HOUR
| where process.executable.name : (".net", "dotnet")
| stats request_count = count(), total_sent_bytes = sum(network.bytes_written), total_received_bytes = sum(network.bytes_read) by host.name, destination.ip, destination.port
| where request_count > 1000 or total_sent_bytes > 100000000 or total_received_bytes > 100000000
| project host.name, destination.ip, destination.port, request_count, total_sent_bytes, total_received_bytes
| rename host.name as DeviceId, destination.ip as RemoteIP, destination.port as RemotePort
| append { generate_value(AlertReason = "Potential DoS attempt against .NET application") }