CVE-2023-21529

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("w3wp.exe", "powershell.exe", "cmd.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "mshta.exe", "bitsadmin.exe", "certutil.exe")
| where FolderPath contains "Exchange Server"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP, RemoteUrl

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (ParentProcessName="w3wp.exe" OR ParentProcessName="powershell.exe" OR ParentProcessName="cmd.exe") (NewProcessName="powershell.exe" OR NewProcessName="cmd.exe" OR NewProcessName="mshta.exe" OR NewProcessName="bitsadmin.exe" OR NewProcessName="certutil.exe") | table _time, ComputerName, ParentProcessName, NewProcessName, CommandLine

Sigma

title: Exchange Server RCE via Deserialization
status: experimental
description: Detects potential remote code execution on Microsoft Exchange Server via deserialization of untrusted data (CVE-2023-21529).
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21529
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\powershell.exe'
            - '\cmd.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
        CommandLine|contains:
            - 'Exchange Server'
    condition: selection
fields:
    - ComputerName
    - User
    - Image
    - CommandLine
    - ParentImage
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and (process.parent.executable.name == "w3wp.exe" or process.parent.executable.name == "powershell.exe" or process.parent.executable.name == "cmd.exe") and (process.executable.name == "powershell.exe" or process.executable.name == "cmd.exe" or process.executable.name == "mshta.exe" or process.executable.name == "bitsadmin.exe" or process.executable.name == "certutil.exe") and process.command_line : "*Exchange Server*"