MSMQ Security Lab

This repository documents a controlled lab review of Microsoft Message Queuing security exposure, focusing on defensive validation, detection evidence, and remediation planning.

The project is positioned as a portfolio artefact: it shows how vulnerability research can be translated into evidence collection, detection engineering, mitigation planning, and validation.

Project Purpose

The purpose of this project is to document a portfolio-safe security lab that connects vulnerability research to practical defensive work.

Scope

This repository focuses on:

• Lab environment notes
• MSMQ service exposure review
• Network capture evidence
• Windows Event Viewer observations
• Snort and Suricata detection examples
• Mitigation and patch validation checklist
• Evidence indexing for screenshots and logs

Repository Structure

MSMQ-Vulnerability/
├── readme.md
├── DISCLAIMER.md
├── references.md
├── docs/
│   ├── lab-summary.md
│   ├── detection-guide.md
│   ├── mitigation-guide.md
│   ├── patch-validation.md
│   └── lab-evidence.md
├── detections/
│   ├── snort.md
│   └── suricata.md
└── screenshots/
    └── README.md

Lab Evidence Summary

The lab screenshots demonstrate:

• MSMQ feature enabled on Windows
• Host listening on TCP port 1801
• Wireshark traffic capture involving TCP 1801
• Event Viewer evidence showing mqsvc.exe application error
• Snort rule creation for MSMQ traffic detection
• Suricata configuration and alert output

See docs/lab-evidence.md and screenshots/README.md for the evidence index.

Detection and Mitigation

• Detection guide: docs/detection-guide.md
• Snort notes: detections/snort.md
• Suricata notes: detections/suricata.md
• Mitigation guide: docs/mitigation-guide.md
• Patch validation: docs/patch-validation.md

References

Official references and lab attribution are listed in references.md.

Disclaimer

This repository is for learning notes, defensive validation, and professional portfolio documentation. See DISCLAIMER.md.