Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)
Flags Exchange web requests with ProxyShell-like /autodiscover.json query patterns and PowerShell/EWS-related parameters, often returning HTTP 401.
- Category
- webserver
- Author
- Florian Roth (Nextron Systems), Rich Warren (SigmaHQ), DRL 1.1
- Published
- 2021-08-07
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches web requests that return HTTP 401 and include URL query patterns associated with ProxyShell-style probing against Exchange, including /autodiscover.json variants and PowerShell/EWS-related parameters. Attackers may use these crafted requests to discover and reach vulnerable endpoints or validate exploit paths, making repeated 401s with these specific URI fragments a useful early signal. It relies on webserver telemetry containing response status and request query strings.
Reporting behind it
- youtu.behttps://youtu.be/5mqid-7zp8k?t=2231
- blog.orange.twhttps://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- peterjson.medium.comhttps://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)
id: 00704de3-c3ea-462a-a8ac-c885424e8408
status: test
description: This rule matches web requests that return HTTP 401 and include URL query patterns associated with ProxyShell-style probing against Exchange, including /autodiscover.json variants and PowerShell/EWS-related parameters. Attackers may use these crafted requests to discover and reach vulnerable endpoints or validate exploit paths, making repeated 401s with these specific URI fragments a useful early signal. It relies on webserver telemetry containing response status and request query strings.
references:
- https://youtu.be/5mqid-7zp8k?t=2231
- https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml
author: Florian Roth (Nextron Systems), Rich Warren, Huntrule Team
date: 2021-08-07
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_1:
sc-status: 401
selection_1_auto:
cs-uri-query|contains: /autodiscover.json
selection_1_uri:
cs-uri-query|contains:
- /powershell
- /mapi/nspi
- /EWS
- X-Rps-CAT
selection_poc:
sc-status: 401
cs-uri-query|contains:
- autodiscover.json?@
- autodiscover.json%3f@
- "%3f@foo.com"
- Email=autodiscover/autodiscover.json
- json?@foo.com
condition: all of selection_1* or selection_poc
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 23eee45e-933b-49f9-ae1b-df706d2d52ef
type: derived