CVE-2023-21554 QueueJumper - Microsoft Message Queuing RCE Detection

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1190	Exploit Public-Facing Application	Exploit Public-Facing Application

Description

Detection queries for CVE-2023-21554 (QueueJumper), a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ) service. Identifies hosts with MSMQ listening on port 1801 and potential exploitation attempts.

Risk

CVE-2023-21554 is a critical CVSS 9.8 RCE vulnerability in MSMQ. Successful exploitation could allow unauthenticated remote code execution on Windows systems with MSMQ enabled (port 1801).

Author

• Name: Gavin Knapp
• Github: https://github.com/m4nbat
• Twitter: https://twitter.com/knappresearchlb
• LinkedIn: https://www.linkedin.com/in/grjk83/
• Website:

References

• https://twitter.com/fabian_bader
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21554

Defender For Endpoint

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == "1801"
| where InitiatingProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == "1801"
| where InitiatingProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

//possible exploitation of CVE-2023-21554
//if successful look for a a follow-up outbound connection to the same external IP or to a possible secondary C2 connection. This would likely result in a child process being spawned from mqsvc.exe that should also be investigated. On the external facing infra this will likely materialise in a webshell or similar.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "mqsvc.exe" and LocalPort == 1801 and ActionType == 'InboundConnectionAccepted'

DeviceProcessEvents
| where ( InitiatingProcessFileName has "mqsvc.exe" and isnotempty(FileName) ) or (InitiatingProcessParentFileName has "mqsvc.exe" and isnotempty(InitiatingProcessFileName) )

Sentinel

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == "1801"
| where InitiatingProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == "1801"
| where InitiatingProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

//possible exploitation of CVE-2023-21554
//if successful look for a a follow-up outbound connection to the same external IP or to a possible secondary C2 connection. This would likely result in a child process being spawned from mqsvc.exe that should also be investigated. On the external facing infra this will likely materialise in a webshell or similar.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "mqsvc.exe" and LocalPort == 1801 and ActionType == 'InboundConnectionAccepted'

DeviceProcessEvents
| where ( InitiatingProcessFileName has "mqsvc.exe" and isnotempty(FileName) ) or (InitiatingProcessParentFileName has "mqsvc.exe" and isnotempty(InitiatingProcessFileName) )