Exchange ProxyShell URL Probing via /autodiscover.json and PowerShell-related Paths

title: Exchange ProxyShell URL Probing via /autodiscover.json and PowerShell-related Paths
id: 00704de3-c3ea-462a-a8ac-c885424e8408
status: test
description: This rule identifies web requests to Exchange-related endpoints whose URI query strings match ProxyShell-style probing patterns, including /autodiscover.json variants and suspicious components such as /powershell, /mapi/nspi, /EWS, and X-Rps-CAT. It is important because attackers commonly use these crafted URL parameters to trigger malicious proxying behavior during exploitation attempts, often resulting in HTTP 401 responses. The detection relies on webserver telemetry fields including the HTTP status (sc-status) and the requested URI query string (cs-uri-query).
references:
  - https://youtu.be/5mqid-7zp8k?t=2231
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml
author: Florian Roth (Nextron Systems), Rich Warren, Huntrule Team
date: 2021-08-07
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_1:
    sc-status: 401
  selection_1_auto:
    cs-uri-query|contains: /autodiscover.json
  selection_1_uri:
    cs-uri-query|contains:
      - /powershell
      - /mapi/nspi
      - /EWS
      - X-Rps-CAT
  selection_poc:
    sc-status: 401
    cs-uri-query|contains:
      - autodiscover.json?@
      - autodiscover.json%3f@
      - "%3f@foo.com"
      - Email=autodiscover/autodiscover.json
      - json?@foo.com
  condition: all of selection_1* or selection_poc
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 23eee45e-933b-49f9-ae1b-df706d2d52ef
    type: derived