CVE-2021-26858 Exchange Exploitation - Non-Standard File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.