ProxyLogon CVE-2021-26858 Virtual Directory Reset Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•56

This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.