Webserver telemetry: Detects Exchange ProxyToken exploitation attempts targeting ECP and InboxRules endpoint

Flags POSTs to Exchange ECP InboxRules endpoints with SecurityToken= that return HTTP 500, indicating ProxyToken exploitation attempts.

FreeUnreviewedSigmacriticalv1

webserver-telemetry-detects-exchange-proxytoken-exploitation-attempts-targeting--56973b50

title: "Webserver telemetry: Detects Exchange ProxyToken exploitation attempts targeting ECP and InboxRules endpoint"
id: 2100cd1b-49a1-49cf-8d57-ff5360977781
status: test
description: This rule identifies potential exploitation activity against Microsoft Exchange ProxyToken authentication bypass by matching HTTP POST requests to specific ECP-related paths and the InboxRules NewObject service. It flags responses with HTTP status 500 and, in one variant, query strings containing SecurityToken= alongside the ECP path, which can indicate an attempted token-based workflow. Telemetry required includes webserver access logs capturing HTTP method, request URI query content, and response status.
references:
  - https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33766/web_cve_2021_33766_msexchange_proxytoken.yml
author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-33766
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_1:
    cs-method: POST
    cs-uri-query|contains|all:
      - /ecp/
      - /RulesEditor/InboxRules.svc/NewObject
    sc-status: 500
  selection_2:
    cs-uri-query|contains|all:
      - SecurityToken=
      - /ecp/
    sc-status: 500
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 56973b50-3382-4b56-bdf5-f51a3183797a
    type: derived

What it detects

This rule identifies potential exploitation activity against Microsoft Exchange ProxyToken authentication bypass by matching HTTP POST requests to specific ECP-related paths and the InboxRules NewObject service. It flags responses with HTTP status 500 and, in one variant, query strings containing SecurityToken= alongside the ECP path, which can indicate an attempted token-based workflow. Telemetry required includes webserver access logs capturing HTTP method, request URI query content, and response status.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.