Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529)

union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(7d)
| where DeviceName has_any ("exchange", "mail")
| where (
    (ActionType == "ProcessCreated" and InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe"))
    or (ActionType == "ProcessCreated" and InitiatingProcessFileName =~ "UMWorkerProcess.exe")
    or (ActionType == "NetworkConnectionEstablished" and InitiatingProcessFileName =~ "w3wp.exe" and RemotePort in (4444, 1234, 8080, 9001))
    or (FolderPath has_any ("\\inetpub\\wwwroot\\aspnet_client\\", "\\Exchange\\FrontEnd\\HttpProxy\\") and FileName endswith ".aspx" and ActionType == "FileCreated")
)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, AccountName

index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval host_lower=lower(host)
| where match(host_lower, "exchange|mail")
| eval parent=lower(ParentImage), child=lower(Image), filepath=lower(TargetFilename)
| where (
    (EventCode=1 AND parent="*w3wp.exe" AND match(child, "(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe)"))
    OR (EventCode=1 AND parent="*umworkerprocess.exe")
    OR (EventCode=3 AND parent="*w3wp.exe" AND DestinationPort IN ("4444","1234","8080","9001"))
    OR (EventCode=11 AND match(filepath, "(aspnet_client|httpproxy)") AND match(filepath, "\.aspx$"))
)
| table _time, host, EventCode, parent, child, CommandLine, DestinationIp, DestinationPort, filepath, User
| sort -_time

sequence by host.name with maxspan=2m
  [process where event.type == "start"
   and process.parent.name : "w3wp.exe"
   and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe")
   and host.name : ("*exchange*", "*mail*")]
  [any where event.category : ("network", "file")
   and (
     (event.category == "network" and destination.port in (4444, 1234, 8080, 9001))
     or (event.category == "file" and file.extension == "aspx" and file.path : ("*aspnet_client*", "*HttpProxy*"))
   )]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, destinationport,
       "processname", "parentprocessname", "username",
       "filepath", QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    ("parentprocessname" ILIKE '%w3wp.exe%'
     AND "processname" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%certutil.exe%'))
    OR ("parentprocessname" ILIKE '%umworkerprocess.exe%')
    OR ("parentprocessname" ILIKE '%w3wp.exe%' AND destinationport IN (4444, 1234, 8080, 9001))
    OR ("filepath" ILIKE '%aspnet_client%' AND "filepath" ILIKE '%.aspx%')
  )
  AND HOSTNAME ILIKE ANY ('%exchange%', '%mail%')
LAST 7 DAYS

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where (%"host" matches "*exchange*" OR %"host" matches "*mail*")
| where (
    (%"EventID" == "1" AND (%"ParentImage" matches "*w3wp.exe*") AND (
      %"Image" matches "*cmd.exe*" OR %"Image" matches "*powershell.exe*" OR
      %"Image" matches "*wscript.exe*" OR %"Image" matches "*cscript.exe*" OR
      %"Image" matches "*mshta.exe*" OR %"Image" matches "*certutil.exe*"
    ))
    OR (%"EventID" == "3" AND %"Image" matches "*w3wp.exe*" AND (%"DestinationPort" == "4444" OR %"DestinationPort" == "1234" OR %"DestinationPort" == "8080" OR %"DestinationPort" == "9001"))
    OR (%"EventID" == "11" AND (%"TargetFilename" matches "*aspnet_client*" OR %"TargetFilename" matches "*HttpProxy*") AND %"TargetFilename" matches "*.aspx*")
)
| fields _messageTime, %"host", %"EventID", %"Image", %"ParentImage", %"CommandLine", %"DestinationIp", %"DestinationPort", %"TargetFilename", %"User"
| sort by _messageTime desc

rule cve_2023_21529_exchange_deserialization {
  meta:
    author = "df00tech"
    description = "Detects exploitation of CVE-2023-21529 Microsoft Exchange deserialization"
    severity = "CRITICAL"
    priority = "HIGH"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
      and re.regex($e.target.process.file.full_path, `(?i)(w3wp\.exe)`)
      and re.regex($e.principal.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe)`)
    )
    or
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
      and re.regex($e.principal.process.file.full_path, `(?i)w3wp\.exe`)
      and $e.target.port in (4444, 1234, 8080, 9001)
    )
    or
    (
      $e.metadata.event_type = "FILE_CREATION"
      and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
      and re.regex($e.target.file.full_path, `(?i)(aspnet_client|HttpProxy)`)
      and re.regex($e.target.file.full_path, `(?i)\.aspx$`)
    )

  condition:
    $e
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NewExecutableWritten")
| filter ComputerName matches "(?i)(exchange|mail)"
| filter (
    (event_simpleName == "ProcessRollup2"
     AND ParentBaseFileName == "w3wp.exe"
     AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe"))
    OR (event_simpleName == "NetworkConnectIP4"
     AND ImageFileName matches "(?i)w3wp\.exe"
     AND RemotePort IN ("4444", "1234", "8080", "9001"))
    OR (event_simpleName == "NewExecutableWritten"
     AND TargetFileName matches "(?i)(aspnet_client|HttpProxy)"
     AND TargetFileName matches "(?i)\.aspx$")
)
| table timestamp, ComputerName, event_simpleName, ParentBaseFileName, FileName, CommandLine, RemoteIP, RemotePort, TargetFileName, UserName
| sort timestamp desc