title: SmarterMail Webshell Upload Activity
description: Detects potential webshell upload or exploitation patterns associated with CVE-2025-52691 targeting SmarterTools SmarterMail.
status: experimental
date: 2026/05/14
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'Web Sites'
        RelativeTargetName|contains: 
            - '.aspx'
            - '.ashx'
            - '.asp'
    filter:
        SubjectUserName|endswith: '$' # Ignore system accounts
    condition: selection and not filter
falsepositives:
    - Legitimate administrator file management
level: critical
---
title: Microsoft Exchange Deserialization Exploit Attempt
description: Detects exploitation attempts of CVE-2023-21529 via suspicious PowerShell activity spawned by Exchange worker processes.
status: experimental
date: 2026/05/14
author: Security Arsenal Research
detection:
    selection_parent:
        ProcessName|endswith: 
            - 'w3wp.exe'
            - 'MSExchangeOWAAppPool.exe'
    selection_child:
        Image|endswith: 
            - 'powershell.exe'
            - 'cmd.exe'
        CommandLine|contains: 
            - 'deserialization'
            - 'ObjectDataProvider'
            - 'TypeInfo'
    condition: selection_parent and selection_child
falsepositives:
    - Administrative Exchange management scripts
level: high
---
title: Qilin Ransomware Payload Execution Pattern
description: Detects typical Qilin execution chains involving PowerShell base64 decoding followed by rapid file encryption.
status: experimental
date: 2026/05/14
author: Security Arsenal Research
detection:
    selection_ps:
        Image|endswith: 'powershell.exe'
        CommandLine|contains: 'FromBase64String'
    selection_process:
        Image|endswith: 
            - '.exe'
            - '.dll'
        CommandLine|contains: 
            - 'encrypt'
            - '-k' # Key parameter often used by Qilin
    timeframe: 1m
    condition: selection_ps | followed by selection_process
falsepositives:
    - Legitimate backup software or encryption utilities
level: critical

// Hunt for Qilin lateral movement and staging
// Focuses on PsExec/WMI usage and high-volume file modifications
let Processes = materialize(
    DeviceProcessEvents 
    | where Timestamp > ago(7d)
    | where FileName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe', 'powershell.exe')
    | where ProcessCommandLine has '-encoded' or ProcessCommandLine has 'Invoke-Command'
);
let FileMods = materialize(
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where ActionType =~ 'FileCreated'
    | where InitiatingProcessFileName =~ 'powershell.exe'
    | project Timestamp, DeviceName, FileName, InitiatingProcessCommandLine, SHA256
);
Processes
| join kind=inner FileMods on DeviceName, Timestamp
| where bin(Timestamp, 1m) == bin(Timestamp, 1m)
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, SHA256
| extend Indication = "Potential Qilin Staging or Lateral Movement"

# QILIN Ransomware Hardening & Hunt Script
# Run as Administrator

Write-Host "[+] Checking for recent suspicious Scheduled Tasks (Persistence)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Select-Object TaskName, TaskPath, Date, Author, Actions | Format-Table -AutoSize

Write-Host "[+] Checking Volume Shadow Copies (VSS) for deletion..." -ForegroundColor Yellow
$vss = vssadmin list shadows
if ($vss -match "No shadow copies found") {
    Write-Host "[!] WARNING: No Shadow Copies found. Potential VSS wipe." -ForegroundColor Red
} else {
    Write-Host "[+] Shadow Copies present." -ForegroundColor Green
}

Write-Host "[+] Enumerating exposed RDP sessions (Check for unauthorized access)..." -ForegroundColor Cyan
$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10"
Get-CimInstance -Query $query | ForEach-Object {
    $logonId = $_.LogonId
    $q = "ASSOCIATORS OF {Win32_LogonSession.LogonId='$logonId'} WHERE AssocClass=Win32_LoggedOnUser"
    $user = Get-CimInstance -Query $q
    Write-Host "User: $($user.Name) | Domain: $($user.Domain) | LogonID: $logonId"
}

Write-Host "[+] Checking SmarterMail/Exchange IIS Logs for recent 500 errors (Exploit Indicators)..." -ForegroundColor Cyan
# Note: Adjust log path as necessary for your environment
$logPaths = @("C:\inetpub\logs\LogFiles\*", "C:\Program Files\SmarterTools\SmarterMail\Logs")
foreach ($path in $logPaths) {
    if (Test-Path $path) {
        Write-Host "Checking $path..."
        Get-ChildItem $path -Recurse -File -ErrorAction SilentlyContinue | 
        Where-Object {$_.LastWriteTime -gt (Get-Date).AddHours(-24)} | 
        Select-String -Pattern "500", "HttpException", "InvalidViewState" | 
        Select-Object Path, Line | Select-Object -First 10
    }
}


---

# Incident Response Priorities

**T-Minus Detection Checklist (Pre-Encryption):**
1.  **Mail Server Logs:** Immediate grep of Exchange and SmarterMail IIS logs for `2026-05-11` to `2026-05-14` for HTTP 500 errors or unusual POST requests to `autodiscover` or `Service.asmx`.
2.  **PowerShell Logs:** Hunt for `ScriptBlockLogging` events (Event ID 4104) containing base64 strings or calls to `System.Management.Automation.AMSIUtils`.
3.  **Network Egress:** Check for large data transfers (exfiltration) occurring 12-48 hours before victim posting dates.

**Critical Assets at Risk:**
- **Legal/Professional Services:** Client databases and case files (Historical Qilin priority).
- **Healthcare:** PHI/Patient transport records.
- **Source Code:** IP theft from technology victims (e.g., AppDirect).

**Containment Actions (Ordered by Urgency):**
1.  **Isolate:** Disconnect Mail Servers and VPN concentrators from the network immediately if patch status is unknown.
2.  **Reset:** Force reset of credentials for all privileged accounts (Domain Admin, Exchange Admin).
3.  **Block:** WAF rules to block access to `/autodiscover` and `/ecp`/`/owa` from external IPs not in allow-lists.

---

# Hardening Recommendations

**Immediate (24 Hours):**
- **Patch Management:** Patch **CVE-2023-21529** (Exchange), **CVE-2025-52691**/**CVE-2026-23760** (SmarterMail), and **CVE-2026-20131** (Cisco FMC). These are confirmed active exploitation vectors.
- **Access Control:** Enforce MFA on all mail server management interfaces and disable HTTP/HTTPS for management if not strictly required.

**Short-Term (2 Weeks):**
- **Network Segmentation:** Move mail servers and firewall management interfaces to a dedicated VLAN with strict egress rules.
- **EDR Coverage:** Ensure EDR sensors are deployed and alerting on IIS worker processes (`w3wp.exe`) spawning PowerShell or CMD shells.

---