CVE-2021-26858 Exchange Exploitation

Status: test
Severity: high
Log source: category file_event, product windows
Author: Bhabesh Raj
Source: github.com/SigmaHQ/sigma

Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: CVE-2021-26858 Exchange Exploitation
id: b06335b3-55ac-4b41-937e-16b7f5d57dfd
status: test
description: |
    Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for
    creation of non-standard files on disk by Exchange Server’s Unified Messaging service
    which could indicate dropping web shells or other malicious content
references:
    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
author: Bhabesh Raj
date: 2021-03-03
modified: 2022-10-09
tags:
    - attack.t1203
    - attack.execution
    - cve.2021-26858
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: 'UMWorkerProcess.exe'
    filter:
        TargetFilename|endswith:
            - 'CacheCleanup.bin'
            - '.txt'
            - '.LOG'
            - '.cfg'
            - 'cleanup.bin'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    Image|endswith: 'UMWorkerProcess.exe'

Stage 2: `not filter`

filter:
    TargetFilename|endswith:
        - 'CacheCleanup.bin'
        - '.txt'
        - '.LOG'
        - '.cfg'
        - 'cleanup.bin'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetFilename`	ends_with	`.LOG`	`excludes:TargetFilename` `field:"TargetFilename" value:".LOG"`
`TargetFilename`	ends_with	`.cfg`	`excludes:TargetFilename` `field:"TargetFilename" value:".cfg"`
`TargetFilename`	ends_with	`.txt`	`excludes:TargetFilename` `field:"TargetFilename" value:".txt"`
`TargetFilename`	ends_with	`CacheCleanup.bin`	`excludes:TargetFilename` `field:"TargetFilename" value:"CacheCleanup.bin"`
`TargetFilename`	ends_with	`cleanup.bin`	`excludes:TargetFilename` `field:"TargetFilename" value:"cleanup.bin"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`UMWorkerProcess.exe`	`field:"Image" kind:ends_with value:"UMWorkerProcess.exe"`