CVE-2023-21529 Elastic Security · Elastic

Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in Elastic Security

Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.

MITRE ATT&CK

Tactic
Initial Access Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=2m
  [process where event.type == "start"
   and process.parent.name : "w3wp.exe"
   and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe")
   and host.name : ("*exchange*", "*mail*")]
  [any where event.category : ("network", "file")
   and (
     (event.category == "network" and destination.port in (4444, 1234, 8080, 9001))
     or (event.category == "file" and file.extension == "aspx" and file.path : ("*aspnet_client*", "*HttpProxy*"))
   )]
critical severity medium confidence

Elastic EQL sequence detection correlating an Exchange IIS worker spawning a suspicious child process followed by anomalous network activity or webshell file creation within 2 minutes.

Data Sources

Elastic EndpointWinlogbeat

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*logs-endpoint.events.file-*

False Positives & Tuning

  • Legitimate Exchange health check scripts that invoke cmd.exe and subsequently make outbound connections
  • Authorized penetration testing generating both process and network events in sequence
  • Deployment automation that writes ASPX files to Exchange directories as part of approved change management

Other platforms for CVE-2023-21529

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Deserialization Webshell Drop on Exchange

    Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client

  2. Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)

    Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami

  3. Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt

    Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process

  4. Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets

    Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host is running Microsoft Exchange Server and identify the specific version and patch level against Microsoft's advisory for CVE-2023-21529.
  2. Review IIS logs on the Exchange server (typically at C:\inetpub\logs\LogFiles\) for anomalous POST requests to Exchange endpoints such as /EWS/, /OWA/, /Autodiscover/, or /PowerShell/ with unusual payload sizes or encoding patterns.
  3. Examine w3wp.exe child process creation events in Sysmon Event ID 1 logs to identify any shells, scripting engines, or reconnaissance tools spawned after the initial suspicious request.
  4. Check for newly created or modified ASPX files in Exchange web directories (C:\inetpub\wwwroot\aspnet_client\, Exchange FrontEnd HttpProxy directories) that could indicate webshell deployment.
  5. Correlate source IPs from IIS logs with threat intelligence feeds and determine if any match known malicious actors or C2 infrastructure.

Containment

  1. Immediately isolate the affected Exchange server from the network using host-based firewall rules or EDR network containment, ensuring continuity of investigation evidence while preventing lateral movement or C2 communication.
  2. Apply Microsoft's security patches for CVE-2023-21529 as published in the MSRC update guide; if patching is not immediately possible, consider temporarily disabling the vulnerable Exchange endpoints or applying URL rewrite rules to block malformed requests.
  3. Revoke and rotate all service accounts, OAuth tokens, and API keys associated with the Exchange server, and audit Active Directory for any newly created accounts or privilege escalations that may have occurred during the exploitation window.

Evidence Collection

  1. Collect a full memory dump of the Exchange server (w3wp.exe process specifically) using tools such as ProcDump or Task Manager before any remediation to preserve in-memory indicators and injected code.
  2. Export IIS access logs, Exchange transport logs, Windows Security Event Logs (IDs 4624, 4625, 4688, 4698), and Sysmon logs covering the suspected exploitation window; hash all collected artifacts with SHA-256 for chain of custody.
  3. Capture network packet captures (PCAP) from the Exchange server's network interface for the incident timeframe if available from network TAPs or NDR tooling, focusing on HTTP/S traffic to Exchange ports.

Escalation Criteria

  • !Escalate to incident response leadership immediately if evidence of successful code execution is confirmed (e.g., webshell present, reverse shell established, new accounts created) given CISA KEV designation indicating active exploitation in the wild.
  • !Escalate if lateral movement is detected from the Exchange server to other internal systems, particularly domain controllers, credential stores, or systems holding sensitive data, indicating the attacker has progressed beyond initial access.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS access logs at C:\inetpub\logs\LogFiles\W3SVC1\ — look for POST requests to /EWS/Exchange.asmx or /PowerShell/ with anomalous Content-Type headers or oversized bodies
  • >Sysmon Event ID 1 entries with ParentImage=w3wp.exe and Image matching cmd.exe, powershell.exe, or other LOLBins
  • >New or modified ASPX files in C:\inetpub\wwwroot\aspnet_client\ or Exchange FrontEnd HttpProxy directories with timestamps matching the suspected intrusion window
  • >Windows Security Event ID 4688 (process creation with command line logging enabled) for shell commands issued post-exploitation
  • >Prefetch files in C:\Windows\Prefetch\ for execution artifacts of tools dropped or executed by the attacker on the Exchange host

Tuning Guidance

Reduce false positives by maintaining an allowlist of known-good Exchange management scripts and their expected parent-child process relationships. Scope the host filter to confirmed Exchange Server hostnames or IP ranges using an asset inventory feed rather than wildcard hostname matching. For the network-based detections, correlate outbound connections with established Exchange mail flow ports (25, 587, 443) and exclude those; flag only connections to non-standard ports or to IPs not in the Exchange connectors configuration. If Exchange hybrid configurations include legitimate PowerShell remoting via w3wp.exe, create exceptions scoped to the specific accounts and source IPs used by those workflows.

Hunting Queries

Broad 30-day retrospective hunt for any process spawned by Exchange IIS worker (w3wp.exe) to identify historical exploitation attempts or previously undetected activity predating the alert.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "net.exe", "whoami.exe", "ipconfig.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe", "rundll32.exe")
| summarize count(), make_set(FileName), make_set(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where count_ > 0
| order by count_ desc
Hunting — SPL
spl 
index=sysmon EventCode=1 ParentImage="*w3wp.exe*"
| stats count by host, Image, CommandLine, _time
| where count > 0
| sort -_time

Hunt for webshell creation in Exchange web-accessible directories over the past 30 days, including ASPX and ASHX handler files that could provide persistent remote access.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has_any ("aspnet_client", "HttpProxy", "OWA", "EWS")
| where FileName endswith ".aspx" or FileName endswith ".ashx"
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
Hunting — SPL
spl 
index=sysmon EventCode=11
| where match(TargetFilename, "(?i)(aspnet_client|HttpProxy|OWA|EWS)")
| where match(TargetFilename, "(?i)\.(aspx|ashx)$")
| table _time, host, TargetFilename, Image, CommandLine
| sort -_time

Atomic Red Team Tests

Test 1 Simulate Deserialization Webshell Drop on Exchange
windows

Simulates the file artifact left by a successful Exchange deserialization exploit by creating a test ASPX file in the aspnet_client directory, mimicking webshell deployment without executing exploit code.

Command

powershell 
echo '<%@ Page Language="C#" %><% Response.Write("CVE-2023-21529-test"); %>' > "C:\inetpub\wwwroot\aspnet_client\test_cve202321529.aspx"

Cleanup

powershell 
del /f "C:\inetpub\wwwroot\aspnet_client\test_cve202321529.aspx"

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client

Expected Detection

Detection rule fires on ASPX file creation in aspnet_client directory on Exchange server hostname

Test 2 Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
windows

Uses PowerShell to launch cmd.exe with a benign command mimicking the process chain created by Exchange deserialization exploits where w3wp.exe spawns a shell. In a lab environment, modify the parent process simulation using a test IIS pool.

Command

powershell 
powershell.exe -Command "Start-Process cmd.exe -ArgumentList '/c whoami > C:\Windows\Temp\exchange_test_output.txt' -Wait"

Cleanup

powershell 
del /f C:\Windows\Temp\exchange_test_output.txt

Expected Telemetry

Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami

Expected Detection

Alert on cmd.exe execution with suspicious command; in full simulation with IIS, detection triggers on w3wp.exe parent relationship

Test 3 Simulate Exchange IIS Worker Outbound C2 Connection Attempt
windows

Tests network-based detection by initiating an outbound TCP connection to a non-standard port from the Exchange server, simulating a reverse shell callback that an attacker would establish after successful deserialization exploitation.

Command

powershell 
powershell.exe -Command "$c = New-Object System.Net.Sockets.TcpClient; try { $c.Connect('192.0.2.1', 4444) } catch { Write-Output 'Connection attempt completed (expected failure in lab)' } finally { $c.Close() }"

Cleanup

powershell 
No cleanup required; connection attempt is non-destructive and uses RFC 5737 documentation IP

Expected Telemetry

Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process

Expected Detection

Network-based detection rule fires on outbound connection to port 4444 from Exchange server; alert correlates with process ancestry if run under IIS simulation

Test 4 Enumerate Exchange Virtual Directories for Webshell Placement Targets
windows

Simulates attacker reconnaissance of Exchange web directories post-exploitation to identify locations for webshell persistence, using only read operations safe for lab environments.

Command

powershell 
cmd.exe /c dir /s /b "C:\inetpub\wwwroot" | findstr /i ".aspx .ashx" > C:\Windows\Temp\exchange_dir_enum.txt && type C:\Windows\Temp\exchange_dir_enum.txt

Cleanup

powershell 
del /f C:\Windows\Temp\exchange_dir_enum.txt

Expected Telemetry

Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands

Expected Detection

Behavioral detection on directory enumeration of Exchange web paths spawned from a suspicious parent process; contributes to process chain correlation with exploitation indicators

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections