Successful Exchange ProxyShell Attack

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).