detection.wiki

Detection rules › Sigma

MSMQ Corrupted Packet Encountered

Status
test
Severity
high
Log source
product windows, service application
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Telemetry coverage

ProviderRecord / event type
MSMQEvent ID 2027: A corrupted packet was encountered.

Rule body

title: MSMQ Corrupted Packet Encountered
id: ae94b10d-fee9-4767-82bb-439b309d5a27
status: test
description: Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation
references:
    - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-21
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MSMQ'
        EventID: 2027
        Level: 2
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Provider_Name: 'MSMQ'
    EventID: 2027
    Level: 2

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Leveleq
  • 2 corpus 2 (sigma 2)
field:"Level" kind:eq value:"2"
Provider_Nameeq
  • MSMQ
field:"Provider_Name" kind:eq value:"MSMQ"