Emerging Threathightest

Exchange ProxyShell Pattern

Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems), Rich WarrenCreated Sat Aug 07Updated Mon Jan 0223eee45e-933b-49f9-ae1b-df706d2d52ef2021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_1:
        sc-status: 401
    selection_1_auto:
        cs-uri-query|contains: '/autodiscover.json'
    selection_1_uri:
        cs-uri-query|contains:
            - '/powershell'
            - '/mapi/nspi'
            - '/EWS'
            - 'X-Rps-CAT'
    selection_poc:
        sc-status: 401
        cs-uri-query|contains:
            # since we don't know how it will appear in the log files, we'll just use all versions
            - 'autodiscover.json?@'
            - 'autodiscover.json%3f@'
            - '%3f@foo.com'
            - 'Email=autodiscover/autodiscover.json'
            - 'json?@foo.com'
    condition: all of selection_1* or selection_poc