CVE-2021-34523

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName =~ "w3wp.exe" or InitiatingProcessFileName =~ "iisexpress.exe" // Exchange-Webserver-Prozesse
| where ProcessCommandLine contains "-ExecutionPolicy Bypass" or ProcessCommandLine contains "-EncodedCommand" // Typische Indikatoren für bösartige PowerShell-Nutzung
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, RemoteIP, RemoteUrl

Splunk SPL

index=windows_events (source="WinEventLog:Microsoft-Windows-PowerShell/Operational" OR source="WinEventLog:Security")
| search (EventCode=4104 OR EventCode=4688)
| search (ProcessName="powershell.exe" AND ParentProcessName IN ("w3wp.exe", "iisexpress.exe"))
| search (CommandLine="*-ExecutionPolicy Bypass*" OR CommandLine="*-EncodedCommand*")
| table _time, host, ProcessName, ParentProcessName, CommandLine, User

Sigma

title: Exchange PowerShell RCE Attempt (CVE-2021-34523)
author: SecBoard
date: 2024/07/30
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688 # Process Creation
    NewProcessName|endswith: '\powershell.exe'
    ParentProcessName|endswith: # Exchange Webserver processes
      - '\w3wp.exe'
      - '\iisexpress.exe'
    CommandLine|contains:
      - '-ExecutionPolicy Bypass'
      - '-EncodedCommand'
  condition: selection
level: critical

Elastic ES|QL

from winlog.eventdata
| where process.executable.name == "powershell.exe"
| where process.parent.executable.name in ("w3wp.exe", "iisexpress.exe")
| where process.command_line : ("*-ExecutionPolicy Bypass*", "*-EncodedCommand*")
| select @timestamp, host.name, process.executable.name, process.parent.executable.name, process.command_line, user.name