huntrule

Windows MSMQ Corrupted Packet Detected (Event ID 2027)

Alerts on MSMQ Event ID 2027 (level 2) indicating corrupted packets received by the service.

FreeUnreviewedSigmahighv1
title: Windows MSMQ Corrupted Packet Detected (Event ID 2027)
id: 7c39ca7f-c431-4f77-a748-d7f6eda480d5
status: test
description: This rule flags Windows Application logs where MSMQ reports a corrupted packet (Provider_Name equals MSMQ) with Event ID 2027 and severity level 2. Corrupted packet reports can indicate malformed or unexpected traffic reaching the MSMQ service, which may be consistent with exploit attempts or probing. It relies on the Windows event telemetry for Provider_Name, EventID, and Level from the application logging.
references:
  - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-21554/win_cve_2023_21554_msmq_corrupted_packet.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-21
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MSMQ
    EventID: 2027
    Level: 2
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ae94b10d-fee9-4767-82bb-439b309d5a27
    type: derived

What it detects

This rule flags Windows Application logs where MSMQ reports a corrupted packet (Provider_Name equals MSMQ) with Event ID 2027 and severity level 2. Corrupted packet reports can indicate malformed or unexpected traffic reaching the MSMQ service, which may be consistent with exploit attempts or probing. It relies on the Windows event telemetry for Provider_Name, EventID, and Level from the application logging.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.