Possible Exploitation of Exchange RCE CVE-2021-42321

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•21

Detects log entries that appear in exploitation attempts against Microsoft Exchange Remote Code Execution vulnerability CVE-2021-42321. Specifically, it looks for Event IDs 6 or 8 from the msexchange-management service containing specific error messages related to cmdlet failures or unhandled exceptions during Get-App operations, which are indicative of the exploitation.