Windows MSExchange Management: Indicators of Exchange RCE attempt for CVE-2021-42321

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

FreeUnreviewedSigmahighv1

windows-msexchange-management-indicators-of-exchange-rce-attempt-for-cve-2021-42-c92f1896

title: "Windows MSExchange Management: Indicators of Exchange RCE attempt for CVE-2021-42321"
id: 38980bdb-d8dc-41b6-abc8-71fd985fbad6
status: test
description: This rule matches Windows msexchange-management log events with Event IDs 6 or 8 that include strings consistent with Exchange PowerShell cmdlet failures and unhandled exceptions referencing Get-App. Attackers exploiting Exchange RCE commonly rely on executing server-side PowerShell and triggering observable error conditions when commands fail. The detection relies on the event identifiers and substring matches within the event data field for specific cmdlet failure and InvalidCastException text.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42321/win_exchange_cve_2021_42321.yml
author: Florian Roth (Nextron Systems), @testanull, Huntrule Team
date: 2021-11-18
modified: 2022-07-12
tags:
  - attack.lateral-movement
  - attack.t1210
  - detection.emerging-threats
logsource:
  product: windows
  service: msexchange-management
detection:
  selection:
    EventID:
      - 6
      - 8
    Data|contains:
      - "Cmdlet failed. Cmdlet Get-App, "
      - "Task Get-App throwing unhandled exception: System.InvalidCastException:"
  condition: selection
falsepositives:
  - Unknown, please report false positives via https://github.com/SigmaHQ/sigma/issues
level: high
license: DRL-1.1
related:
  - id: c92f1896-d1d2-43c3-92d5-7a5b35c217bb
    type: derived

What it detects

This rule matches Windows msexchange-management log events with Event IDs 6 or 8 that include strings consistent with Exchange PowerShell cmdlet failures and unhandled exceptions referencing Get-App. Attackers exploiting Exchange RCE commonly rely on executing server-side PowerShell and triggering observable error conditions when commands fail. The detection relies on the event identifiers and substring matches within the event data field for specific cmdlet failure and InvalidCastException text.

Known false positives

Unknown, please report false positives via https://github.com/SigmaHQ/sigma/issues

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.