huntrule

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

FreeReviewedSigma · High · v5
Product
windows
Service
msexchange-management
Author
Florian Roth (Nextron Systems), @testanull (SigmaHQ), DRL 1.1
Published
2021-11-18
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Windows msexchange-management log entries with EventID 6 or 8 that contain evidence of Exchange PowerShell cmdlet failures. It looks for “Cmdlet failed. Cmdlet Get-App” and an “Unhandled exception: System.InvalidCastException” string, which can appear during exploitation attempts targeting CVE-2021-42321. Telemetry relies on the Exchange management logging captured by the Windows msexchange-management service, specifically the EventID and the embedded message/data fields containing those error fragments.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange
Possible .NET Remoting Deserialisation Exploitation via REM Endpoint
Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)
Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation
Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Suspicious SysAidServer Child Processes via Java on Windows
Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation
Pivot detection · T1210 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.