Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in Elastic Security
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
sequence by host.name with maxspan=2m
[process where event.type == "start"
and process.parent.name : "w3wp.exe"
and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe")
and host.name : ("*exchange*", "*mail*")]
[any where event.category : ("network", "file")
and (
(event.category == "network" and destination.port in (4444, 1234, 8080, 9001))
or (event.category == "file" and file.extension == "aspx" and file.path : ("*aspnet_client*", "*HttpProxy*"))
)]Elastic EQL sequence detection correlating an Exchange IIS worker spawning a suspicious child process followed by anomalous network activity or webshell file creation within 2 minutes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Exchange health check scripts that invoke cmd.exe and subsequently make outbound connections
- Authorized penetration testing generating both process and network events in sequence
- Deployment automation that writes ASPX files to Exchange directories as part of approved change management
Other platforms for CVE-2023-21529
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Webshell Drop on Exchange
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client
- Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami
- Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt
Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process
- Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets
Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands
Unlock Pro Content
Get the full detection package for CVE-2023-21529 including response playbook, investigation guide, and atomic red team tests.