Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in IBM QRadar
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
QRadar Detection Query
SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
sourceip, destinationip, destinationport,
"processname", "parentprocessname", "username",
"filepath", QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND (
("parentprocessname" ILIKE '%w3wp.exe%'
AND "processname" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%certutil.exe%'))
OR ("parentprocessname" ILIKE '%umworkerprocess.exe%')
OR ("parentprocessname" ILIKE '%w3wp.exe%' AND destinationport IN (4444, 1234, 8080, 9001))
OR ("filepath" ILIKE '%aspnet_client%' AND "filepath" ILIKE '%.aspx%')
)
AND HOSTNAME ILIKE ANY ('%exchange%', '%mail%')
LAST 7 DAYSQRadar AQL query to identify Exchange deserialization exploitation indicators including suspicious child processes, outbound connections from w3wp.exe, and webshell artifacts.
Data Sources
Required Tables
False Positives & Tuning
- Exchange administration via PowerShell remoting that routes through IIS worker processes
- Legacy Exchange management tools that spawn cmd.exe for compatibility
- Security products hooking into Exchange processes and generating network telemetry
Other platforms for CVE-2023-21529
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Webshell Drop on Exchange
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client
- Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami
- Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt
Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process
- Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets
Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands
Unlock Pro Content
Get the full detection package for CVE-2023-21529 including response playbook, investigation guide, and atomic red team tests.