CVE-2021-33766

Sentinel/Defender KQL

ExchangeIISLog
| where csUriStem contains "/ecp/" and scStatus == 200
| where csUserName == "-" or isempty(csUserName)
| summarize count() by cIp, csUriStem, csMethod, csUserAgent
| where count_ > 5 // Adjust threshold based on baseline
| project cIp, csUriStem, csMethod, csUserAgent, count_

Splunk SPL

index=ms_exchange sourcetype=iis_access_log cs_uri_stem="/ecp/*" sc_status=200 (cs_username="-" OR cs_username="")
| stats count by c_ip, cs_uri_stem, cs_method, cs_user_agent
| where count > 5 // Adjust threshold based on baseline

Sigma

title: Exchange ECP Auth Bypass Information Disclosure Attempt
status: experimental
description: Detects potential attempts to exploit CVE-2021-33766 by identifying unauthenticated access to Exchange ECP web services.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-21-798/
logsource:
    product: exchange
    service: iis
detection:
    selection:
        cs_uri_stem|contains: '/ecp/'
        sc_status: 200
        cs_username: '-'
    condition: selection
falsepositives:
    - Legitimate unauthenticated ECP access (if any, verify environment)
level: high

Elastic ES|QL

from iis_logs
| where cs_uri_stem like '/ecp/%' and sc_status == 200 and (cs_username == '-' or cs_username == null)
| stats count() by c_ip, cs_uri_stem, cs_method, cs_user_agent
| where count > 5 // Adjust threshold based on baseline
| project c_ip, cs_uri_stem, cs_method, cs_user_agent, count