---
title: Potential Exchange Server Deserialization Exploit (CVE-2023-21529)
id: a1b2c3d4-5e6f-7890-1a2b-3c4d5e6f7890
description: Detects potential exploitation of Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability. Indicator: Suspicious backend process activity.
status: stable
author: Security Arsenal
date: 2026/05/12
references:
    - https://msrc.microsoft.com/advisory
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 4663
        ObjectName|contains: 'Microsoft.Exchange.'
        AccessMask: '0x10180'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Administrative access
level: high
---
title: SmarterMail Unrestricted Upload or Auth Bypass Attempt
id: b2c3d4e5-6f7a-8901-2b3c-4d5e6f7890a1
description: Detects exploitation attempts against SmarterMail (CVE-2025-52691/CVE-2026-23760) via IIS logs.
status: stable
author: Security Arsenal
date: 2026/05/12
logsource:
    product: webserver
    service: iis
detection:
    selection_uri:
        cs-uri-stem|contains:
            - '/Services/MailBoxService.asmx'
            - '/Services/FeedService.asmx'
            - '/Grid.html'  
    selection_status:
        sc-status: 200
    selection_method:
        cs-method: POST
    condition: all of selection_
falsepositives:
    - Legitimate SmarterMail API usage
level: critical
---
title: Qilin Ransomware Process Chain Execution
id: c3d4e5f6-7a8b-9012-3c4d-5e6f7890a1b2
description: Detects the typical Qilin execution chain involving PowerShell obfuscation, RClone usage, and Vssadmin shadow copy deletion.
status: stable
author: Security Arsenal
date: 2026/05/12
logsource:
    product: windows
    service: process_creation
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_rclone:
        Image|endswith: '\rclone.exe'
    selection_ps:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: 'EncodedCommand'
    condition: 1 of selection_
falsepositives:
    - System administration tasks
level: high

// Hunt for Qilin lateral movement and exfil indicators
// Focus: RClone usage, Vssadmin deletion, and unusual SMB access
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rclone.exe", "vssadmin.exe", "procdump.exe", "psexec.exe", "psexec64.exe")
   or (ProcessCommandLine contains "delete" and ProcessCommandLine contains "shadows")
   or (FileName =~ "powershell.exe" and ProcessCommandLine contains "EncodedCommand" and ProcessCommandLine contains "FromBase64String")
| project DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Timestamp, FolderPath
| extend AlertContext = pack("Device", DeviceName, "Account", AccountName, "Command", ProcessCommandLine)

<#
.SYNOPSIS
    Rapid Response: Check for Qilin Persistence and Shadow Copy Deletion.
.DESCRIPTION
    Enumerates scheduled tasks created in the last 7 days and checks for recent Vssadmin execution events.
#>

Write-Host "[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan

Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, State, Author, Date | Format-Table -AutoSize

Write-Host "[*] Checking Security Event Log for Vssadmin 'Delete Shadows' execution (ID 4688)..." -ForegroundColor Cyan

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($Events) {
    $Events | Where-Object { $_.Message -match "vssadmin.exe" -and $_.Message -match "delete" } | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "[!] No recent vssadmin events found or log access denied." -ForegroundColor Yellow
}


---

# Incident Response Priorities

Based on Qilin's specific playbook observed in this campaign, IR teams should execute the following T-minus checklist immediately:

1.  **T-minus 60 Mins:** Isolate **Exchange Servers** and **Cisco FMC** appliances. Qilin uses these as beachheads. Do not reboot; capture memory if possible.
2.  **Hunt for `rclone`:** Scan EDR logs and `%TEMP%` directories for `rclone.exe`. This is their primary exfil tool.
3.  **Audit O365/Exchange:** Look for "Forwarding SMTP Address" rules created recently. Qilin often establishes email backdoors.
4.  **Critical Assets:** Qilin prioritizes **CAD drawings and architectural plans** (Construction sector victims) and **Customer PII databases** (Business Services). Segregate these file shares immediately.

**Containment Actions:**
*   Revoke all VPN credentials for users in the affected sectors (Construction/Business Services) that have logged in from anomalous geolocations (ES/AR/MX).
*   Disable the `IIS` and `MSExchange` service accounts temporarily if compromise is confirmed on Exchange.

---

# Hardening Recommendations