Emerging Threatcriticaltest

Successful Exchange ProxyShell Attack

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems), Rich WarrenCreated Mon Aug 09Updated Mon Jan 02992be1eb-e5da-437e-9a54-6d13b57bb4d82021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_auto:
        cs-uri-query|contains: '/autodiscover.json'
    selection_uri:
        cs-uri-query|contains:
            - '/powershell'
            - '/mapi/nspi'
            - '/EWS'
            - 'X-Rps-CAT'
    selection_success:
        sc-status:
            - 200
            - 301
    condition: selection_auto and selection_uri and selection_success