CVE-2026-96960

Sentinel/Defender KQL

let threshold = 500; // Example: 500% increase in network activity or CPU usage compared to baseline
Heartbeat
| where Category == "Azure Arc Servers" or Category == "Servers"
| summarize NetworkBytesSent = sum(NetworkBytesSent), NetworkBytesReceived = sum(NetworkBytesReceived), CpuUsage = avg(CpuUsage) by Computer, bin(TimeGenerated, 5m)
| extend TotalNetworkTraffic = NetworkBytesSent + NetworkBytesReceived
| serialize
| project TimeGenerated, Computer, TotalNetworkTraffic, CpuUsage
| join kind=inner (Heartbeat
    | where Category == "Azure Arc Servers" or Category == "Servers"
    | summarize BaselineNetworkTraffic = avg(NetworkBytesSent + NetworkBytesReceived), BaselineCpuUsage = avg(CpuUsage) by Computer
) on Computer
| where TotalNetworkTraffic > BaselineNetworkTraffic * (1 + threshold/100) or CpuUsage > BaselineCpuUsage * (1 + threshold/100)
| project TimeGenerated, Computer, TotalNetworkTraffic, CpuUsage, BaselineNetworkTraffic, BaselineCpuUsage, Anomaly = "Potential DoS (Amplification) Attack"

Splunk SPL

index=* (sourcetype=perfmon:cpu OR sourcetype=perfmon:network)
| timechart span=5m avg(Value) as avg_value by host, counter
| streamstats window=10 avg(avg_value) as baseline_avg_value by host, counter
| eval anomaly_score = (avg_value - baseline_avg_value) / baseline_avg_value * 100
| where anomaly_score > 500 // Example: 500% increase
| table _time, host, counter, avg_value, baseline_avg_value, anomaly_score

Sigma

title: .NET Asymmetric Resource Consumption DoS
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential denial of service attacks via asymmetric resource consumption in .NET applications.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96960
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: 
      - '\dotnet.exe'
      - '\w3wp.exe'
    CommandLine|contains:
      - 'System.Net.Http'
      - 'System.Web'
  condition: selection
fields:
  - Image
  - CommandLine
level: high

Elastic ES|QL

from host.metrics as hm
| where hm.metric.name == "system.network.in.bytes" or hm.metric.name == "system.network.out.bytes" or hm.metric.name == "system.cpu.usage"
| summarize avg_value = avg(hm.metric.value) by span(hm.timestamp, 5m), hm.host.name, hm.metric.name
| window baseline_avg_value = avg(avg_value) over (range 10 preceding by hm.host.name, hm.metric.name) 
| eval anomaly_score = (avg_value - baseline_avg_value) / baseline_avg_value * 100
| where anomaly_score > 500 // Example: 500% increase
| select hm.timestamp, hm.host.name, hm.metric.name, avg_value, baseline_avg_value, anomaly_score