THEGENTLEMEN Ransomware: Global Surge Exploiting Exchange & Mail Server Flaws

title: Suspicious Process Spawn by Microsoft Exchange (THEGENTLEMEN Initial Access)
id: 52f8f2a1-9b1a-4f1c-8b2c-3d4e5f6a7b8c
description: Detects suspicious processes spawned by Microsoft Exchange w3wp or MSExchange backend processes, often associated with deserialization exploits like CVE-2023-21529.
status: experimental
date: 2026/05/10
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            '\w3wp.exe'
            '\MSExchangeOWAAppPool.exe'
            '\MSExchangeECPAppPool.exe'
    filter_legit:
        Image|endswith:
            '\powershell.exe'
            '\cmd.exe'
            '\whoami.exe'
            '\net.exe'
            '\net1.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administration by Exchange admins (rare)
level: critical
---
title: SmarterMail Web Shell Upload Indicators (CVE-2025-52691)
id: 88c7d6e1-2a3b-4c5d-9e0f-1a2b3c4d5e6f
description: Detects file creation patterns associated with the SmarterMail unrestricted upload vulnerability (CVE-2025-52691) exploited by THEGENTLEMEN.
status: experimental
date: 2026/05/10
author: Security Arsenal
logsource:
    category: file_creation
    product: windows
detection:
    selection_path:
        TargetFilename|contains: 
            '\\Mails\\'
            '\\Services\\'
    selection_extension:
        TargetFilename|endswith:
            '.aspx'
            '.ashx'
            '.asmx'
    selection_user:
        User|contains: 
            'IUSR'
            'IIS_IUSRS'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates (verify timing)
level: high
---
title: Large Volume Data Staging Pre-Encryption
description: Identifies rapid file creation and modification in a short timeframe, typical of ransomware data staging before encryption.
status: experimental
date: 2026/05/10
author: Security Arsenal
logsource:
    product: windows
    category: file_create
detection:
    selection:
        FileName|contains:
            '.zip'
            '.rar'
            '.7z'
    condition: selection | count() > 50 by TargetFilename within 5m
level: medium


**KQL (Microsoft Sentinel) — Lateral Movement Hunt**
Hunts for SMB and WMI lateral movement often used by THEGENTLEMEN operators after exploiting Exchange or Mail servers.

kql
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ("powershell.exe", "cmd.exe", "wmic.exe", "psexec.exe", "psexec64.exe")
| where ProcessCommandLine contains "-enc" or 
      ProcessCommandLine contains "Invoke-Command" or
      ProcessCommandLine contains "New-SmbMapping" or
      ProcessCommandLine contains "net use"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| summarize count() by DeviceName, FileName
| where count_ > 5


**PowerShell — Rapid Response Hardening**
This script checks for common persistence mechanisms used by THEGENTLEMEN and verifies if critical services are exposed.

powershell
# THEGENTLEMEN Response Script
Write-Host "Checking for THEGENTLEMEN Indicators of Compromise..." -ForegroundColor Cyan

# 1. Check for recently created Scheduled Tasks (Persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date.LastTaskTime -gt (Get-Date).AddDays(-2) }
if ($suspiciousTasks) {
    Write-Host "[ALERT] Recently modified Scheduled Tasks found:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, LastTaskTime, Author
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 2. Check for Exchange IIS Logs Exploitation (CVE-2023-21529 check)
$exchangePath = "C:\inetpub\logs\LogFiles\W3SVC1"
if (Test-Path $exchangePath) {
    $recentLogs = Get-ChildItem $exchangePath | Sort-Object LastWriteTime -Descending | Select-Object -First 1
    $exploitPattern = Select-String -Path $recentLogs.FullName -Pattern "\".*autodiscover.*\"|.*POST.*200" -Context 0,2
    if ($exploitPattern) {
        Write-Host "[ALERT] Potential Autodiscover exploitation patterns found in IIS logs." -ForegroundColor Red
    }
}

Write-Host "Response script complete. Review RDP and VPN logs manually."


---