title: Potential Exchange Server Deserialization Exploit CVE-2023-21529
description: Detects potential exploitation of Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability via w3wp.exe suspicious process creation.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\whoami.exe'
    condition: selection
falsepositives:
    - Legitimate Exchange management scripts
level: high

tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.21529
---
title: SmarterMail Web Shell or Suspicious Activity
description: Detects suspicious process execution patterns associated with SmarterMail exploitation or web shell activity.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        ParentImage|contains: 'MailService'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\net.exe'
    selection_cmd:
        CommandLine|contains:
            - 'whoami'
            - 'net user'
            - 'net localgroup administrators'
    condition: 1 of selection*
falsepositives:
    - Administrative troubleshooting
level: critical

tags:
    - attack.web_shell
    - attack.t1505.003
    - cve.2025.52691
---
title: Ransomware Qilin Typical Lateral Movement Pattern
description: Detects patterns often used by Qilin affiliates for lateral movement and data staging prior to encryption.
author: Security Arsenal Research
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '-accepteula'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    selection_rclone:
        Image|endswith: '\rclone.exe'
    condition: 1 of selection_
falsepositives:
    - Administrative remote management
level: high

tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.exfiltration

// Hunt for Qilin Affiliate Activity: Web Shell + Lateral Movement + Data Staging
let Processes = materialize (
    DeviceProcessEvents 
    | where Timestamp > ago(7d)
);
// 1. Identify Potential Web Shell Access (Exchange/SmarterMail)
let WebShellActivity = Processes
| where InitiatingProcessFileName in ("w3wp.exe", "MailService.exe", "WebConfig.exe")
| where ProcessFileName in ("powershell.exe", "cmd.exe", "csc.exe")
| project DeviceId, Timestamp, AccountName, ProcessCommandLine, FolderPath, InitiatingProcessFileName;
// 2. Identify Lateral Movement (PsExec/WMI/SMB)
let LateralMovement = Processes
| where ProcessFileName in ("psexec.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has "invoke-command" or ProcessCommandLine has "new-psession" or ProcessCommandLine contains "\\\"
| project DeviceId, Timestamp, AccountName, ProcessCommandLine, ProcessFileName;
// 3. Identify Data Staging/Exfil Tools (Rclone, WinRAR)
let ExfilTools = Processes
| where ProcessFileName in ("rclone.exe", "winrar.exe", "7z.exe")
| project DeviceId, Timestamp, AccountName, ProcessCommandLine, ProcessFileName;
// Correlate activities
union WebShellActivity, LateralMovement, ExfilTools
| summarize ActivityCount=count(), make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1h)
| where ActivityCount > 2
| order by ActivityCount desc

<#
.SYNOPSIS
    Qilin Ransomware Triage Script
.DESCRIPTION
    Checks for indicators of compromise (IOCs) associated with Qilin operations: 
    Scheduled Tasks, Shadow Copy manipulation, and recent process execution.
#>

Write-Host "[+] Starting Qilin Ransomware Triage Check..." -ForegroundColor Cyan

# 1. Check for recently created Scheduled Tasks (Common persistence)
Write-Host "\n[!] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($schTasks) {
    $schTasks | Format-List TaskName, Author, Date, Action, State
} else {
    Write-Host "No suspicious recent tasks found." -ForegroundColor Green
}

# 2. Check Volume Shadow Copies (Qilin deletes these)
Write-Host "\n[!] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
try {
    $vss = vssadmin list shadows
    if ($vss -match "No shadow copies") {
        Write-Host "WARNING: No Shadow Copies found. Potential deletion event." -ForegroundColor Red
    } else {
        Write-Host "Shadow Copies exist." -ForegroundColor Green
    }
} catch {
    Write-Host "Error checking VSS: $_" -ForegroundColor DarkGray
}

# 3. Check for Rclone or uncommon archiving processes in last 24h
Write-Host "\n[!] Checking for Data Exfil Tools (Rclone/WinRAR) in Event Logs..." -ForegroundColor Yellow
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
$suspiciousProcs = @("rclone", "winrar", "7z", "procdump")
foreach ($proc in $suspiciousProcs) {
    $found = $events | Where-Object { $_.Message -like "*$proc*" }
    if ($found) {
        Write-Host "ALERT: Found $proc execution:" -ForegroundColor Red
        $found | Select-Object TimeCreated, Message | Format-List
    }
}

Write-Host "\n[+] Triage Complete." -ForegroundColor Cyan


# Incident Response Priorities

1.  **T-Minus Detection Checklist:**
    *   **IIS/Exchange Logs:** Scan `C:\inetpub\logs\LogFiles\` for POST requests containing anomalous serialization data or long base64 strings (indicators of CVE-2023-21529).
    *   **Web Shells:** Hunt for `.aspx`, `.jsp`, or `.php` files in web roots with recent modification timestamps.
    *   **Firewall Telemetry:** Immediately review Cisco FMC logs for administrative logins or configuration changes originating from unexpected IPs (CVE-2026-20131).

2.  **Critical Assets at Risk:**
    *   **Active Directory:** Domain Controllers are primary targets for credential dumping (DCSync).
    *   **Backups:** Qilin aggressively deletes Volume Shadow Copies (`vssadmin delete shadows`). Disconnect backup appliances immediately.
    *   **File Servers:** High-value data repositories for legal and manufacturing clients.

3.  **Containment Actions:**
    *   Isolate affected Exchange servers and Cisco FMC appliances from the network.
    *   Revoke all privileged session tokens (Kerberos) for admins logged into exposed systems.
    *   Enforce MFA reset for all accounts that accessed the exploited VPN/Firewall interfaces.

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch Management:** Apply patches for CVE-2023-21529 (Exchange), CVE-2026-20131 (Cisco FMC), and SmarterMail CVEs immediately. If patching is impossible, disable external access to these management interfaces via firewall ACLs.
*   **Account Security:** Force password resets for all service accounts associated with Exchange and Firewall management.
*   **Ingress Filtering:** Block internet access to TCP/443 and TCP/80 for management interfaces (FMC/SmarterMail) from untrusted IP ranges.

**Short-Term (2 Weeks):**
*   **Network Segmentation:** Move management planes (Firewall managers, Exchange Admin Centers) to a dedicated, strictly controlled Admin VLAN with no direct internet access.
*   **EDR Deployment:** Ensure EDR sensors are installed and reporting on Edge/Email servers, a common blind spot.
*   **Phishing Resilience:** Implement strict DMARC/SPF/DKIM policies to prevent email-based initial access vectors which remain a secondary path for this group.