Potential CVE-2023-21554 QueueJumper Exploitation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.