Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

FreeReviewedSigma · High · v5

Product: windows
Service: msexchange-management
Author: Florian Roth (Nextron Systems), @testanull (SigmaHQ), DRL 1.1
Published: 2021-11-18
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows msexchange-management log entries with EventID 6 or 8 that contain evidence of Exchange PowerShell cmdlet failures. It looks for “Cmdlet failed. Cmdlet Get-App” and an “Unhandled exception: System.InvalidCastException” string, which can appear during exploitation attempts targeting CVE-2021-42321. Telemetry relies on the Exchange management logging captured by the Windows msexchange-management service, specifically the EventID and the embedded message/data fields containing those error fragments.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Suspicious SysAidServer Child Processes via Java on Windows

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Pivot detection · T1210 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msexchange-management-indicators-of-exchange-rce-attempt-for-cve-2021-42-c92f1896

title: Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation
id: 38980bdb-d8dc-41b6-abc8-71fd985fbad6
status: test
description: "This rule matches Windows msexchange-management log entries with EventID 6 or 8 that contain evidence of Exchange PowerShell cmdlet failures. It looks for “Cmdlet failed. Cmdlet Get-App” and an “Unhandled exception: System.InvalidCastException” string, which can appear during exploitation attempts targeting CVE-2021-42321. Telemetry relies on the Exchange management logging captured by the Windows msexchange-management service, specifically the EventID and the embedded message/data fields containing those error fragments."
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-42321/win_exchange_cve_2021_42321.yml
author: Florian Roth (Nextron Systems), @testanull, Huntrule Team
date: 2021-11-18
modified: 2022-07-12
tags:
  - attack.lateral-movement
  - attack.t1210
  - detection.emerging-threats
logsource:
  product: windows
  service: msexchange-management
detection:
  selection:
    EventID:
      - 6
      - 8
    Data|contains:
      - "Cmdlet failed. Cmdlet Get-App, "
      - "Task Get-App throwing unhandled exception: System.InvalidCastException:"
  condition: selection
falsepositives:
  - Unknown, please report false positives via https://github.com/SigmaHQ/sigma/issues
level: high
license: DRL-1.1
related:
  - id: c92f1896-d1d2-43c3-92d5-7a5b35c217bb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL