Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths
Flags Exchange-targeted web requests with /autodiscover.json plus exploit URI fragments returning 200/301.
FreeReviewedSigma · Critical · v5
- Category
- webserver
- Author
- Florian Roth (Nextron Systems), Rich Warren (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
What it detects
This rule identifies web requests targeting Microsoft Exchange-related endpoints with ProxyShell-style URI patterns and HTTP status codes indicating success (200 or 301). Attackers often use these success responses to confirm exploitation progress and reach post-exploitation stages. It relies on web server telemetry capturing request query strings (cs-uri-query), the presence of specific Exchange/PowerShell/MAPI components in those queries, and the resulting HTTP status code.
Reporting behind it
- youtu.behttps://youtu.be/5mqid-7zp8k?t=2231
- blog.orange.twhttps://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- peterjson.medium.comhttps://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
webserver-activity-indicating-successful-proxyshell-exploit-targeting-exchange-992be1eb
title: Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths
id: a7811a94-0a02-4a79-9953-d297ab541ea7
status: test
description: This rule identifies web requests targeting Microsoft Exchange-related endpoints with ProxyShell-style URI patterns and HTTP status codes indicating success (200 or 301). Attackers often use these success responses to confirm exploitation progress and reach post-exploitation stages. It relies on web server telemetry capturing request query strings (cs-uri-query), the presence of specific Exchange/PowerShell/MAPI components in those queries, and the resulting HTTP status code.
references:
- https://youtu.be/5mqid-7zp8k?t=2231
- https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml
author: Florian Roth (Nextron Systems), Rich Warren, Huntrule Team
date: 2021-08-09
modified: 2023-01-02
tags:
- attack.initial-access
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_auto:
cs-uri-query|contains: /autodiscover.json
selection_uri:
cs-uri-query|contains:
- /powershell
- /mapi/nspi
- /EWS
- X-Rps-CAT
selection_success:
sc-status:
- 200
- 301
condition: selection_auto and selection_uri and selection_success
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 992be1eb-e5da-437e-9a54-6d13b57bb4d8
type: derived