huntrule

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

FreeReviewedSigma · High · v5
Product
windows
Service
msexchange-management
Author
Florian Roth (Nextron Systems), @testanull (SigmaHQ), DRL 1.1
Published
2021-11-18
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Windows msexchange-management log entries with EventID 6 or 8 that contain evidence of Exchange PowerShell cmdlet failures. It looks for “Cmdlet failed. Cmdlet Get-App” and an “Unhandled exception: System.InvalidCastException” string, which can appear during exploitation attempts targeting CVE-2021-42321. Telemetry relies on the Exchange management logging captured by the Windows msexchange-management service, specifically the EventID and the embedded message/data fields containing those error fragments.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange
Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Suspicious SysAidServer Child Processes via Java on Windows
Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host
Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation
Pivot detection · T1210 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.