MSMQ Corrupted Packet Encountered (CVE-2023-21554)

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•24

Detects corrupted packets sent to the MSMQ service, which could indicate an attempt to exploit CVE-2023-21554, a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The rule specifically looks for EventID 2027 with a Level of 2 (Error) from the 'MSMQ' provider in the Windows Application event log.