Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(7d)
| where DeviceName has_any ("exchange", "mail")
| where (
(ActionType == "ProcessCreated" and InitiatingProcessFileName =~ "w3wp.exe" and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe"))
or (ActionType == "ProcessCreated" and InitiatingProcessFileName =~ "UMWorkerProcess.exe")
or (ActionType == "NetworkConnectionEstablished" and InitiatingProcessFileName =~ "w3wp.exe" and RemotePort in (4444, 1234, 8080, 9001))
or (FolderPath has_any ("\\inetpub\\wwwroot\\aspnet_client\\", "\\Exchange\\FrontEnd\\HttpProxy\\") and FileName endswith ".aspx" and ActionType == "FileCreated")
)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, AccountNameDetects post-exploitation indicators following CVE-2023-21529 abuse: child processes spawned by Exchange IIS worker (w3wp.exe), suspicious network connections from Exchange processes, and webshell drops in Exchange web directories.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Exchange maintenance scripts executed via IIS worker process
- Authorized red team or penetration testing activities against Exchange infrastructure
- Custom monitoring agents that spawn from w3wp.exe as part of APM tooling
Other platforms for CVE-2023-21529
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Webshell Drop on Exchange
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client
- Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami
- Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt
Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process
- Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets
Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands
Unlock Pro Content
Get the full detection package for CVE-2023-21529 including response playbook, investigation guide, and atomic red team tests.