Exchange ProxyShell Exploitation Attempt
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Sigma
