Windows Application: MSMQ Corrupted Packet (Event ID 2027, Level 2)
Alerts on MSMQ Event ID 2027 (level 2) indicating corrupted packets received by the service.
FreeReviewedSigma · High · v5
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-21
- Updated
- 2026-07-31
What it detects
This rule flags Windows application events indicating that MSMQ encountered a corrupted packet, specifically Event ID 2027 with severity level 2 and Provider_Name set to MSMQ. Such errors matter because malformed or corrupted traffic may indicate attempted exploitation or disruptive probing against the MSMQ service. The detection relies on Windows application telemetry carrying the MSMQ provider and the event’s Event ID and level.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-msmq-corrupted-packet-detected-event-id-2027-ae94b10d
title: "Windows Application: MSMQ Corrupted Packet (Event ID 2027, Level 2)"
id: 7c39ca7f-c431-4f77-a748-d7f6eda480d5
status: test
description: This rule flags Windows application events indicating that MSMQ encountered a corrupted packet, specifically Event ID 2027 with severity level 2 and Provider_Name set to MSMQ. Such errors matter because malformed or corrupted traffic may indicate attempted exploitation or disruptive probing against the MSMQ service. The detection relies on Windows application telemetry carrying the MSMQ provider and the event’s Event ID and level.
references:
- https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-21554/win_cve_2023_21554_msmq_corrupted_packet.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-21
tags:
- attack.execution
- detection.emerging-threats
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: MSMQ
EventID: 2027
Level: 2
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: ae94b10d-fee9-4767-82bb-439b309d5a27
type: derived