CVE-2021-26858

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("w3wp.exe", "powershell.exe", "cmd.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "mshta.exe", "bitsadmin.exe", "certutil.exe")
| where FolderPath contains "\Exchange Server\"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (ParentProcessName="w3wp.exe" OR ParentProcessName="powershell.exe" OR ParentProcessName="cmd.exe") (NewProcessName="powershell.exe" OR NewProcessName="cmd.exe" OR NewProcessName="mshta.exe" OR NewProcessName="bitsadmin.exe" OR NewProcessName="certutil.exe") CommandLine="*Exchange Server*" | table _time, Host, ParentProcessName, NewProcessName, CommandLine

Sigma

title: Exchange ProxyLogon RCE Behavioral Detection
status: experimental
description: Detects suspicious process creation patterns indicative of ProxyLogon RCE on Exchange servers.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\powershell.exe'
      - '\cmd.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
    CommandLine|contains: 'Exchange Server'
  condition: selection
level: high

Elastic ES|QL

from process where event.type == "start" and
  (process.parent.executable.endswith("w3wp.exe") or
   process.parent.executable.endswith("powershell.exe") or
   process.parent.executable.endswith("cmd.exe")) and
  (process.executable.endswith("powershell.exe") or
   process.executable.endswith("cmd.exe") or
   process.executable.endswith("mshta.exe") or
   process.executable.endswith("bitsadmin.exe") or
   process.executable.endswith("certutil.exe")) and
  process.args contains "Exchange Server"
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line