Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation
Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.
- Product
- windows
- Service
- msexchange-management
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches command-line patterns consistent with a PowerShell Set-OabVirtualDirectory invocation that includes specific external URL and malicious page-load content markers. Attackers can use this behavior to modify Exchange virtual directory settings as part of post-exploitation activity following ProxyLogon. It relies on Windows msexchange-management telemetry capturing the executed command text and parameter substrings such as eval(request) and embedded script indicators.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation"
id: 5ec9cf59-cd4e-4492-a07a-f09c8a3ec71f
status: test
description: This rule matches command-line patterns consistent with a PowerShell Set-OabVirtualDirectory invocation that includes specific external URL and malicious page-load content markers. Attackers can use this behavior to modify Exchange virtual directory settings as part of post-exploitation activity following ProxyLogon. It relies on Windows msexchange-management telemetry capturing the executed command text and parameter substrings such as eval(request) and embedded script indicators.
references:
- https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-01-23
tags:
- attack.t1587.001
- attack.resource-development
logsource:
product: windows
service: msexchange-management
detection:
keywords_cmdlet:
"|all":
- OabVirtualDirectory
- " -ExternalUrl "
keywords_params:
- eval(request
- http://f/<script
- '"unsafe"};'
- function Page_Load()
condition: keywords_cmdlet and keywords_params
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0
type: derived