CVE-2021-26857

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where InitiatingProcessFileName =~ "w3wp.exe" // IIS Worker Process for Exchange
| where InitiatingProcessCommandLine contains "Exchange"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where ParentImage="C:\Program Files\Microsoft\Exchange Server\V15\Bin\w3wp.exe"
| where Image IN ("C:\Windows\System32\cmd.exe", "C:\Windows\System32\powershell.exe", "C:\Windows\System32\wscript.exe", "C:\Windows\System32\cscript.exe", "C:\Windows\System32\mshta.exe")
| table _time, Host, ParentImage, Image, CommandLine, Hashes

Sigma

title: Exchange ProxyLogon RCE Behavioral Detection
id: 7e7f8e8d-9c0b-4d1a-8e7f-8e8d9c0b4d1a
status: experimental
description: Detects suspicious process creation originating from the Exchange IIS worker process (w3wp.exe), indicative of successful exploitation of vulnerabilities like ProxyLogon (CVE-2021-26857).
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2021.26857
  - cisa_kev

Elastic ES|QL

from process where event.type == "start" and 
  process.parent.executable.path : "*\\w3wp.exe" and 
  process.executable.path : ("*\\cmd.exe", "*\\powershell.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe")
| select @timestamp, host.name, process.parent.executable.path, process.executable.path, process.command_line, process.hash.sha256