CVE-2021-27065

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("w3wp.exe", "powershell.exe", "cmd.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| where FolderPath !startswith "C:\Program Files\Microsoft\Exchange Server"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessParentFileName

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) EventCode=1 (ParentImage="*\\w3wp.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\cmd.exe") (Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe") NOT Image="C:\Program Files\Microsoft\Exchange Server*" | table _time, host, ParentImage, Image, CommandLine

Sigma

title: Exchange Server RCE - Suspicious Process Creation
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\powershell.exe'
      - '\cmd.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter:
    Image|startswith: 'C:\Program Files\Microsoft\Exchange Server'
  condition: selection and not filter
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and (process.parent.executable.endswith("w3wp.exe") or process.parent.executable.endswith("powershell.exe") or process.parent.executable.endswith("cmd.exe")) and (process.executable.endswith("powershell.exe") or process.executable.endswith("cmd.exe") or process.executable.endswith("mshta.exe") or process.executable.endswith("certutil.exe") or process.executable.endswith("bitsadmin.exe")) and not process.executable.startswith("C:\\Program Files\\Microsoft\\Exchange Server")