Windows QueueJumper exploitation attempt via mqsvc.exe spawning scripting and utility processes

title: Windows QueueJumper exploitation attempt via mqsvc.exe spawning scripting and utility processes
id: 23a252ac-9aa7-4350-9931-be1844038f74
status: test
description: This rule flags process creation events where Windows service binary mqsvc.exe is the parent of common command and script interpreters. Attackers may leverage these parent-child relationships to execute commands or payloads following a QueueJumper-style exploitation attempt for unauthorized code execution. It relies on Windows process creation telemetry, matching parent image path ending with mqsvc.exe and child image path ending with common LOLBins such as cmd.exe, PowerShell, MSHTA, Regsvr32, Rundll32, and others.
references:
  - https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21554/proc_creation_win_exploit_cve_2023_21554_queuejumper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-12
tags:
  - attack.privilege-escalation
  - attack.execution
  - cve.2023-21554
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \Windows\System32\mqsvc.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 53207cc2-0745-4c19-bc72-80be1cc16b3f
    type: derived