---
title: Potential SmarterMail Exploitation CVE-2025-52691
description: Detects potential exploitation of SmarterMail unrestricted file upload vulnerability via suspicious IIS log patterns or file creation.
id: 0c7a8d9a-1b2c-3f4e-5d6a-7b8c9d0e1f2a
status: experimental
date: 2026/05/01
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 'SmarterMail'
        RelativeTargetName|contains: 
            - '.aspx'
            - '.ashx'
            - '.asp'
    condition: selection
falsepositives:
    - Legitimate admin uploads
level: high
---
title: Microsoft Exchange Deserialization Exploit Attempt CVE-2023-21529
description: Detects suspicious activity related to Exchange Deserialization vulnerabilities, specifically looking for unusual processes spawned by w3wp.exe.
id: 1d8b0e1a-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
date: 2026/05/01
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
        ParentImage|contains: '\ClientAccess\'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\whoami.exe'
    filter_legit:
        User|contains: 'SYSTEM' # Filter out standard system ops, requires tuning
    condition: selection_parent and selection_child and not filter_legit
falsepositives:
    - Administrative maintenance
level: critical
---
title: Ransomware VSS Shadow Copy Deletion
description: Detects commands used to delete Volume Shadow Copies, a common precursor to encryption by ransomware gangs like FULCRUMSEC.
id: 2e9c1f2b-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
date: 2026/05/01
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_keyword:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'wbadmin delete catalog'
            - 'bcdedit /set {default} recoveryenabled No'
    condition: selection_keyword
level: high

// Hunt for lateral movement and staging associated with FULCRUMSEC
// Looks for PsExec/WMI usage and large file transfers to non-standard paths
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in ("psexec.exe", "psexec64.exe", "wmic.exe")
| where FileName in ("cmd.exe", "powershell.exe", "rundll32.exe")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "winword.exe")
    | where FileSize > 1000000 // > 1MB staged files
    | project Timestamp, DeviceName, FileName, FolderPath, FileSize
) on DeviceName
| distinct Timestamp, HostName, FileName, FolderPath, FileSize, InitiatingProcessCommandLine

<#
.SYNOPSIS
    FULCRUMSEC Rapid Response Hardening Script
.DESCRIPTION
    Checks for exposed RDP, enumerates suspicious scheduled tasks (last 7 days), 
    and audits IIS/Exchange log patterns for recent exploitation.
#>

Write-Host "[+] Starting FULCRUMSEC Response Hardening..." -ForegroundColor Cyan

# 1. Check for recent Scheduled Tasks (Persistence)
Write-Host "[*] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author

# 2. Check for RDP Exposure (Network Profile)
Write-Host "[*] Checking Network Profiles for RDP exposure..." -ForegroundColor Yellow
Get-NetFirewallRule -DisplayName "Remote Desktop*" | 
    Where-Object {$_.Enabled -eq 'True' -and $_.Profile -match 'Any|Public'} | 
    Select-Object DisplayName, Profile, Direction

# 3. Audit IIS Logs for SmarterMail/Exchange Exploitation (Last 24h)
$logPaths = @("C:\inetpub\logs\LogFiles\", "C:\Program Files\Microsoft\Exchange Server\V15\Logging\")
$cutoffTime = (Get-Date).AddHours(-24)

foreach ($path in $logPaths) {
    if (Test-Path $path) {
        Write-Host "[*] Scanning $path for suspicious 500/400 errors..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | 
        Where-Object {$_.LastWriteTime -gt $cutoffTime} | 
        Select-String -Pattern " (500|400) " | Select-Object -First 5 Path, Line
    }
}
Write-Host "[+] Script Complete." -ForegroundColor Green


---

# Incident Response Priorities