Exchange Exploitation CVE-2021-28480

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects successful exploitation attempts of the Microsoft Exchange Server vulnerability CVE-2021-28480. This vulnerability allows for remote code execution. The rule specifically looks for POST requests to '/owa/calendar/a' that result in an HTTP 503 status code, indicating a potential successful exploitation or a server error due to the exploit.