CVE-2021-34473

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "powershell.exe" // Exchange worker process or potential post-exploitation
| where ProcessCommandLine contains "autodiscover" or InitiatingProcessCommandLine contains "autodiscover" // Focus on Autodiscover context
| where ProcessCommandLine contains "http" or ProcessCommandLine contains "https" // Look for external/unusual connections
| where not (ProcessCommandLine contains "localhost" or ProcessCommandLine contains "127.0.0.1") // Exclude common internal calls
| summarize count() by DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemotePort
| where count_ > 5 // Adjust threshold based on baseline
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=ms_exchange sourcetype=iis_access_logs uri_path="*autodiscover.svc*" (http_method=POST OR http_method=GET) 
| regex _raw!="(?i)(localhost|127\.0\.0\.1)" 
| stats count by host, uri_path, http_method, client_ip 
| where count > 5 
| table host, uri_path, http_method, client_ip, count

Sigma

title: Exchange Autodiscover SSRF/RCE Attempt
status: experimental
description: Detects suspicious activity related to Microsoft Exchange Autodiscover service, potentially indicating exploitation of CVE-2021-34473 (ProxyShell).
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-21-821/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473
logsource:
  product: windows
  service: iis
detection:
  selection:
    cs_uri_stem|contains: 'autodiscover.svc'
    cs_method: ['POST', 'GET']
    c_ip|!startswith: ['10.', '172.16.', '172.17.', '172.18.', '172.19.', '172.20.', '172.21.', '172.22.', '172.23.', '172.24.', '172.25.', '172.26.', '172.27.', '172.28.', '172.29.', '172.30.', '172.31.', '192.168.', '127.0.0.1']
  condition: selection
fields:
  - c_ip
  - cs_uri_stem
  - cs_method
  - sc_status
type: log
falsepositives:
  - Legitimate Autodiscover requests from external clients (requires tuning based on environment)
level: high

Elastic ES|QL

from iis_logs
| where url.path : "*autodiscover.svc*"
| where http.request.method in ("POST", "GET")
| where not (source.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.0.0.1"))
| summarize count() by host.name, url.path, http.request.method, source.ip
| where count > 5
| project host.name, url.path, http.request.method, source.ip, count