huntrule

Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation

Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.

FreeReviewedSigma · Critical · v2
Product
windows
Service
msexchange-management
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-08-09
Updated
2026-07-31
AnalysisDetection
title: "Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation"
id: 5ec9cf59-cd4e-4492-a07a-f09c8a3ec71f
status: test
description: This rule matches command-line patterns consistent with a PowerShell Set-OabVirtualDirectory invocation that includes specific external URL and malicious page-load content markers. Attackers can use this behavior to modify Exchange virtual directory settings as part of post-exploitation activity following ProxyLogon. It relies on Windows msexchange-management telemetry capturing the executed command text and parameter substrings such as eval(request) and embedded script indicators.
references:
  - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-01-23
tags:
  - attack.t1587.001
  - attack.resource-development
logsource:
  product: windows
  service: msexchange-management
detection:
  keywords_cmdlet:
    "|all":
      - OabVirtualDirectory
      - " -ExternalUrl "
  keywords_params:
    - eval(request
    - http://f/<script
    - '"unsafe"};'
    - function Page_Load()
  condition: keywords_cmdlet and keywords_params
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0
    type: derived