Detect Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529) in Sumo Logic CSE
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where (%"host" matches "*exchange*" OR %"host" matches "*mail*")
| where (
(%"EventID" == "1" AND (%"ParentImage" matches "*w3wp.exe*") AND (
%"Image" matches "*cmd.exe*" OR %"Image" matches "*powershell.exe*" OR
%"Image" matches "*wscript.exe*" OR %"Image" matches "*cscript.exe*" OR
%"Image" matches "*mshta.exe*" OR %"Image" matches "*certutil.exe*"
))
OR (%"EventID" == "3" AND %"Image" matches "*w3wp.exe*" AND (%"DestinationPort" == "4444" OR %"DestinationPort" == "1234" OR %"DestinationPort" == "8080" OR %"DestinationPort" == "9001"))
OR (%"EventID" == "11" AND (%"TargetFilename" matches "*aspnet_client*" OR %"TargetFilename" matches "*HttpProxy*") AND %"TargetFilename" matches "*.aspx*")
)
| fields _messageTime, %"host", %"EventID", %"Image", %"ParentImage", %"CommandLine", %"DestinationIp", %"DestinationPort", %"TargetFilename", %"User"
| sort by _messageTime descSumo Logic query detecting Exchange deserialization abuse via Sysmon process creation, network, and file creation events on Exchange servers.
Data Sources
Required Tables
False Positives & Tuning
- IIS-hosted Exchange management applications that invoke shell commands as part of normal functionality
- Authorized security assessments generating process chains from Exchange worker processes
- Custom ASPX-based Exchange extensions deployed to web-accessible directories
Other platforms for CVE-2023-21529
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Webshell Drop on Exchange
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename containing 'aspnet_client' and extension '.aspx'; DeviceFileEvents in Defender with FolderPath matching aspnet_client
- Test 2Simulate w3wp.exe Spawning cmd.exe (Exchange IIS Post-Exploitation)
Expected signal: Sysmon Event ID 1 showing powershell.exe spawning cmd.exe with whoami command; Windows Security Event ID 4688 with ProcessCommandLine containing whoami
- Test 3Simulate Exchange IIS Worker Outbound C2 Connection Attempt
Expected signal: Sysmon Event ID 3 (NetworkConnect) showing outbound connection attempt to port 4444; DeviceNetworkEvents with RemotePort 4444 and InitiatingProcessFileName matching the test process
- Test 4Enumerate Exchange Virtual Directories for Webshell Placement Targets
Expected signal: Sysmon Event ID 1 for cmd.exe and findstr.exe execution; command line arguments containing Exchange directory paths; Windows Security Event ID 4688 with dir and findstr commands
Unlock Pro Content
Get the full detection package for CVE-2023-21529 including response playbook, investigation guide, and atomic red team tests.