Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation
Alerts when mqsvc.exe spawns common scripting/utility executables often used for unauthorized execution.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-12
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the parent process is mqsvc.exe and the child process is one of several common script or command execution binaries (cmd.exe, PowerShell, cscript, mshta, regsvr32, rundll32, schtasks, wmic, wscript, wsl.exe). Such behavior may indicate an attacker leveraging the MSMQ service to achieve unauthorized code execution associated with CVE-2023-21554. The detection relies on Windows process creation telemetry capturing parent/child image paths.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-queuejumper-exploitation-attempt-via-mqsvc-exe-spawning-scripting-and-ut-53207cc2
title: "Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation"
id: 23a252ac-9aa7-4350-9931-be1844038f74
status: test
description: This rule flags Windows process creation events where the parent process is mqsvc.exe and the child process is one of several common script or command execution binaries (cmd.exe, PowerShell, cscript, mshta, regsvr32, rundll32, schtasks, wmic, wscript, wsl.exe). Such behavior may indicate an attacker leveraging the MSMQ service to achieve unauthorized code execution associated with CVE-2023-21554. The detection relies on Windows process creation telemetry capturing parent/child image paths.
references:
- https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21554/proc_creation_win_exploit_cve_2023_21554_queuejumper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-12
tags:
- attack.privilege-escalation
- attack.execution
- cve.2023-21554
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \Windows\System32\mqsvc.exe
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \schtasks.exe
- \wmic.exe
- \wscript.exe
- \wsl.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 53207cc2-0745-4c19-bc72-80be1cc16b3f
type: derived