Webserver activity indicating successful ProxyShell exploit targeting Exchange

title: Webserver activity indicating successful ProxyShell exploit targeting Exchange
id: a7811a94-0a02-4a79-9953-d297ab541ea7
status: test
description: This rule flags webserver requests that include the '/autodiscover.json' query and also contain Exchange-related paths such as '/powershell', '/mapi/nspi', '/EWS', or the header-like token 'X-Rps-CAT'. It further requires HTTP status codes of 200 or 301, indicating the exploitation attempt likely reached a successful response. Attackers may use this behavior to gain remote code execution against Exchange by leveraging crafted request patterns, so correlating the specific URI fragments with successful responses is important. Telemetry relied on includes webserver request URI query data and the resulting HTTP status code.
references:
  - https://youtu.be/5mqid-7zp8k?t=2231
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml
author: Florian Roth (Nextron Systems), Rich Warren, Huntrule Team
date: 2021-08-09
modified: 2023-01-02
tags:
  - attack.initial-access
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_auto:
    cs-uri-query|contains: /autodiscover.json
  selection_uri:
    cs-uri-query|contains:
      - /powershell
      - /mapi/nspi
      - /EWS
      - X-Rps-CAT
  selection_success:
    sc-status:
      - 200
      - 301
  condition: selection_auto and selection_uri and selection_success
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 992be1eb-e5da-437e-9a54-6d13b57bb4d8
    type: derived