Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in Google Chronicle
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
YARA-L Detection Query
rule cve_2023_21529_exchange_deserialization {
meta:
author = "df00tech"
description = "Detects exploitation of CVE-2023-21529 Microsoft Exchange deserialization"
severity = "CRITICAL"
priority = "HIGH"
events:
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
and re.regex($e.target.process.file.full_path, `(?i)(w3wp\.exe)`)
and re.regex($e.principal.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe)`)
)
or
(
$e.metadata.event_type = "NETWORK_CONNECTION"
and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
and re.regex($e.principal.process.file.full_path, `(?i)w3wp\.exe`)
and $e.target.port in (4444, 1234, 8080, 9001)
)
or
(
$e.metadata.event_type = "FILE_CREATION"
and re.regex($e.principal.hostname, `(?i)(exchange|mail)`)
and re.regex($e.target.file.full_path, `(?i)(aspnet_client|HttpProxy)`)
and re.regex($e.target.file.full_path, `(?i)\.aspx$`)
)
condition:
$e
}Chronicle YARA-L rule detecting Exchange deserialization exploitation indicators: suspicious child processes from Exchange IIS worker, anomalous outbound connections, and webshell drops.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Exchange health monitoring that spawns diagnostic tools via IIS worker processes
- Authorized penetration test exercises against Exchange mail infrastructure
- Change management deployments writing ASPX handlers to Exchange virtual directories
Other platforms for CVE-2023-21529
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Webshell Drop on Exchange
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client
- Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami
- Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt
Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process
- Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets
Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands
Unlock Pro Content
Get the full detection package for CVE-2023-21529 including response playbook, investigation guide, and atomic red team tests.