Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation

title: "Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation"
id: 23a252ac-9aa7-4350-9931-be1844038f74
status: test
description: This rule flags Windows process creation events where the parent process is mqsvc.exe and the child process is one of several common script or command execution binaries (cmd.exe, PowerShell, cscript, mshta, regsvr32, rundll32, schtasks, wmic, wscript, wsl.exe). Such behavior may indicate an attacker leveraging the MSMQ service to achieve unauthorized code execution associated with CVE-2023-21554. The detection relies on Windows process creation telemetry capturing parent/child image paths.
references:
  - https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21554/proc_creation_win_exploit_cve_2023_21554_queuejumper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-12
tags:
  - attack.privilege-escalation
  - attack.execution
  - cve.2023-21554
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \Windows\System32\mqsvc.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 53207cc2-0745-4c19-bc72-80be1cc16b3f
    type: derived