Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
7
6
5
4
2
Contributors
12
6
5
3
Categories
21
9
8
6
6
Platforms
20
7
1
Products / Services
19
12
6
5
5
MITRE Techniques
21
17
6
6
6
CVEs
71
71
64
58
49
26
IDS Classtypes
4
1
IDS Protocols
5
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Detects web shell deployment and subsequent execution activities associated with the StrikeShark threat. The detection covers two primary behaviors: 1) IIS worker processes (w3wp.exe or UMWorkerProcess.exe) spawning suspicious child processes (cmd.exe, powershell.exe, etc.) indicating shell command execution, and 2) IIS worker processes creating potential web shell files (.aspx, .ashx, .asmx, .svc) within sensitive web root directories, including Exchange and SharePoint paths.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
This rule detects specific patterns indicative of successful ProxyLogon exploitation targeting Microsoft Exchange's OabVirtualDirectory. It looks for the invocation of the 'Set-OabVirtualDirectory' cmdlet in conjunction with suspicious parameters often used in post-exploitation activities, such as injecting web shell code ('eval(request'), or manipulating the ExternalUrl with malicious scripts ('http://f/<script', '"unsafe"};', 'function Page_Load()'). This combination suggests an attacker has successfully leveraged the ProxyLogon vulnerabilities to execute arbitrary commands and modify Exchange configurations for persistence or further access.
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Page 2 of 2