---
title: Potential Exchange Deserialization Exploit (CVE-2023-21529)
id: 0c8a3b12-6d12-45a4-9b31-9c6f2e1c0d5a
description: Detects suspicious process spawning by Microsoft Exchange Unified Messaging or Frontend processes, often associated with deserialization exploits.
status: experimental
date: 2026/05/02
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\MSExchangeFrontendAppPool.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Administrative management
level: high
tags:
    - cve.2023.21529
    - ransomware
    - fulcrumsec
---
title: SmarterMail Suspicious File Upload or Command Execution
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects command execution or file modification patterns associated with SmarterMail exploits (CVE-2025-52691).
status: experimental
date: 2026/05/02
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\MailService.exe'
    selection_cli:
        CommandLine|contains:
            - 'whoami'
            - 'net user'
            - 'ping -n'
    condition: all of selection_*
falsepositives:
    - Legitimate administration via service console
level: critical
tags:
    - cve.2025.52691
    - webshell
    - fulcrumsec
---
title: React/Node.js Server Compromise Indicators
id: e5f6g7h8-9012-34cd-efab-567890abcdef0
description: Detects Node.js or React development servers spawning shell commands, indicative of RCE (CVE-2025-55182).
status: experimental
date: 2026/05/02
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - 'node.exe'
            - 'nodejs.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\bash.exe' # Windows Subsystem for Linux
    condition: all of selection_*
falsepositives:
    - Legitimate developer build scripts
level: high
tags:
    - cve.2025.55182
    - rce
    - fulcrumsec

// Hunt for lateral movement and staging related to FulcrumSec
// Focuses on unusual admin share access and massive data copy
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (InitiatingProcessFileName has "node.exe" 
    or InitiatingProcessFileName has "w3wp.exe" 
    or InitiatingProcessFileName has "MailService.exe")
    and (FileName in ("cmd.exe", "powershell.exe", "pwsh.exe"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where ActionType == "FileCreated" 
    | where FolderPath contains "\Windows\Temp" or FolderPath contains "\inetpub" 
    | extend FileSizeMB = FileSize / 1024 / 1024
    | where FileSizeMB > 10 // Filter for non-trivial files
) on DeviceName, Timestamp
| summarize arg_max(Timestamp, *) by DeviceName, SHA1

<#
.SYNOPSIS
    FulcrumSec Emergency Hardening & Hunt Script
.DESCRIPTION
    Checks for signs of CVE-2023-21529, SmarterMail compromise, and React RCE indicators.
#>

Write-Host "[*] Starting FULCRUMSEC Hunt and Hardening..." -ForegroundColor Cyan

# 1. Check Exchange IIS Logs for Deserialization Patterns (Simplified)
$exchangePath = "C:\inetpub\logs\LogFiles\W3SVC1"
if (Test-Path $exchangePath) {
    Write-Host "[+] Scanning Exchange IIS Logs for suspicious 500 errors..." -ForegroundColor Yellow
    Get-ChildItem $exchangePath -Recurse -Filter *.log | 
    Select-String -Pattern "500" -Context 2,2 | Select-Object -First 20
}

# 2. Check SmarterMail Service for Suspicious Child Processes
Write-Host "[+] Checking SmarterMail processes..." -ForegroundColor Yellow
$smarterMailProc = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "MailService.exe" }
if ($smarterMailProc) {
    Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $smarterMailProc.ProcessId } | 
    Select-Object Name, CommandLine
} else {
    Write-Host "[-] SmarterMail not detected or not running." -ForegroundColor Gray
}

# 3. Check for Node.js spawning Shell (React RCE)
Write-Host "[+] Checking for Node.js spawning Cmd/PowerShell..." -ForegroundColor Yellow
Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "node.exe" } | ForEach-Object {
    $parentID = $_.ProcessId
    $children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $parentID }
    if ($children.Name -match "(cmd|powershell|pwsh)") {
        Write-Host "[!] ALERT: Node.js PID $($parentID) is spawning a shell!" -ForegroundColor Red
        $children | Select-Object Name, CommandLine
    }
}

Write-Host "[*] Script complete. Review alerts." -ForegroundColor Cyan


---

# Incident Response Priorities

Based on FULCRUMSEC's observed playbook:

1.  **T-Minus Detection Checklist:**
    *   Verify if Microsoft Exchange servers have applied patches for **CVE-2023-21529**.
    *   Inspect IIS logs on Exchange and SmarterMail servers for suspicious `POST` requests to `/api/` or `/rpc` endpoints.
    *   Look for unexpected scheduled tasks on Windows Servers (lateral movement trigger).

2.  **Critical Assets for Exfiltration:**
    *   **Databases:** SQL Server instances backing ERP/LexisNexis-style data services.
    *   **Source Code:** Repositories targeted at Tech victims (ReFocus AI, Hatica).
    *   **Email Archives:** PST/OST files accessible via SmarterMail or Exchange MAPI.

3.  **Containment Actions:**
    *   **Immediate:** Isolate Exchange and SmarterMail servers from the network. Do not reboot (capture memory first).
    *   **Secondary:** Reset credentials for service accounts associated with the "MailService" and "IIS AppPool" identities.
    *   **Tertiary:** Block outbound egress to known FULCRUMSec C2 IPs and non-standard ports (e.g., 8080, 4443) at the firewall.

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Management:** Immediately deploy the out-of-band security updates for **Microsoft Exchange (CVE-2023-21529)** and **SmarterMail (CVE-2025-52691)**.
*   **Network Segmentation:** Ensure VPN/Direct access to Exchange and Web Management interfaces is blocked from the public internet; enforce Zero Trust Network Access (ZTNA) for administration.
*   **WAF Rules:** Update Web Application Firewalls to block signatures related to **Meta React Server Components deserialization** and SmarterMail arbitrary file uploads.

**Short-Term (2 Weeks):**
*   **Architecture:** Move email and web management interfaces to a dedicated management VLAN without direct internet access.
*   **Endpoint Detection:** Deploy EDR policies specifically alerting on `w3wp.exe` or `node.exe` spawning `cmd.exe`.
*   **Backup Verification:** Validate that offline backups are immutable and test restoration procedures for Exchange databases.

---