Detection rules › Sigma
CVE-2021-33766 Exchange ProxyToken Exploitation
Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
title: CVE-2021-33766 Exchange ProxyToken Exploitation
id: 56973b50-3382-4b56-bdf5-f51a3183797a
status: test
description: Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766
references:
- https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server
author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2021-33766
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_1:
cs-method: 'POST'
cs-uri-query|contains|all:
- '/ecp/'
- '/RulesEditor/InboxRules.svc/NewObject'
sc-status: 500
selection_2:
cs-uri-query|contains|all:
- 'SecurityToken='
- '/ecp/'
sc-status: 500
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_1
selection_1:
cs-method: 'POST'
cs-uri-query|contains|all:
- '/ecp/'
- '/RulesEditor/InboxRules.svc/NewObject'
sc-status: 500
Stage 2: selection_2
selection_2:
cs-uri-query|contains|all:
- 'SecurityToken='
- '/ecp/'
sc-status: 500
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-method | eq |
| field:"cs-method" kind:eq value:"POST" |
cs-uri-query | match |
| field:"cs-uri-query" kind:match |
sc-status | eq |
| field:"sc-status" kind:eq value:"500" |