CVE-2021-33766 Exchange ProxyToken Exploitation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.