CVE-2021-42321

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "Exchange" and ProcessCommandLine contains "powershell" and ProcessCommandLine contains "-command"
| where not (ProcessCommandLine contains "Get-" or ProcessCommandLine contains "Set-" or ProcessCommandLine contains "New-" or ProcessCommandLine contains "Remove-") // Filter out common legitimate cmdlets
| where FileName !in ("powershell.exe", "cmd.exe") or (FileName in ("powershell.exe", "cmd.exe") and ProcessCommandLine contains "-EncodedCommand") // Look for encoded commands or unusual executables
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, InitiatingProcessAccountName
| extend Anomaly = "Potential RCE via Exchange Cmdlet Argument Manipulation (CVE-2021-42321)"

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 (CommandLine="*Exchange*" AND CommandLine="*powershell*" AND CommandLine="*-command*") NOT (CommandLine="*Get-*" OR CommandLine="*Set-*" OR CommandLine="*New-*" OR CommandLine="*Remove-*") | where not match(NewProcessName, "(?i)(powershell.exe|cmd.exe)") OR (match(NewProcessName, "(?i)(powershell.exe|cmd.exe)") AND CommandLine="*-EncodedCommand*") | table _time, Host, Process, CommandLine, ParentProcess, User | rename Process as NewProcessName, CommandLine as NewProcessCommandLine, ParentProcess as ParentProcessName | eval Anomaly = "Potential RCE via Exchange Cmdlet Argument Manipulation (CVE-2021-42321)"

Sigma

title: Exchange RCE CVE-2021-42321 Behavioral Detection
status: experimental
description: Detects potential exploitation of CVE-2021-42321 on Microsoft Exchange servers by looking for unusual cmdlet execution patterns.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42321
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\Exchange\Bin\*' # Adjust based on actual Exchange process paths
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - '-command'
    filter_legitimate:
        CommandLine|contains:
            - 'Get-'
            - 'Set-'
            - 'New-'
            - 'Remove-'
    condition: selection and not filter_legitimate
fields:
    - CommandLine
    - ParentCommandLine
    - User
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and process.parent.executable.path : "*Exchange*" and process.executable.path : ("*powershell.exe", "*cmd.exe") and process.args : "*-command*" and not (process.args : ("*Get-*", "*Set-*", "*New-*", "*Remove-*"))
| project @timestamp, host.name, process.executable.path, process.args, process.parent.executable.path, user.name
| append { from process where event.category == "process" and event.type == "start" and process.parent.executable.path : "*Exchange*" and process.executable.path : ("*powershell.exe", "*cmd.exe") and process.args : "*-EncodedCommand*" }
| set anomaly = "Potential RCE via Exchange Cmdlet Argument Manipulation (CVE-2021-42321)"