IIS Webserver SSRF ProxyLogon Reset virtual directory via ECP SetObject POST

title: IIS Webserver SSRF ProxyLogon Reset virtual directory via ECP SetObject POST
id: d0308e86-9088-4fd2-a7e6-ad04312d79a7
status: test
description: This rule flags HTTP POST requests to the Exchange ECP DDIService SetObject endpoint that return HTTP 200 and include parameters indicating a Reset operation targeting a VirtualDirectory. The behavior is significant because resetting virtual directories is a step consistent with SSRF-driven manipulation during ProxyLogon-style exploitation. It relies on webserver telemetry capturing HTTP method, status code, request URI stem, query parameters, and the authenticated username ending with a '$' character.
references:
  - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26858/web_cve_2021_26858_iis_rce.yml
author: frack113, Huntrule Team
date: 2021-08-10
modified: 2023-05-08
tags:
  - cve.2021-26858
  - detection.emerging-threats
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
  definition: "Requirements: The POST request body data must be collected in order to make use of this detection"
detection:
  selection:
    cs-method: POST
    sc-status: 200
    cs-uri-stem: /ecp/DDI/DDIService.svc/SetObject
    cs-uri-query|contains|all:
      - schema=Reset
      - VirtualDirectory
    cs-username|endswith: $
  keywords:
    "|all":
      - POST
      - 200
      - /ecp/DDI/DDIService.svc/SetObject
      - schema=Reset
      - VirtualDirectory
      - $
  condition: selection or keywords
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: effee1f6-a932-4297-a81f-acb44064fa3a
    type: derived