ProxyShell Exchange CVE-2021-34473/34523/31207 Autodiscover Path Traversal

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

Detects attempts to exploit Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), collectively known as ProxyShell. The rule monitors inbound HTTP requests targeting the /autodiscover/ endpoint with specific path traversal patterns and malicious components used to stage web shells or execute arbitrary commands.