EXPL_Exchange_ProxyShell_Aug21_1

Rule Info

Av Ratio
0.46
Required Modules
[]
Name
EXPL_Exchange_ProxyShell_Aug21_1
Score
70
Date
2021-08-08
Minimum Yara
2.2.0
Author
Florian Roth
Modified
2021-08-09
Description
Detects ProxyShell exploitation attempts in log files
Tags
['EXPLOIT', 'SCRIPT', 'T1090']
Rule Hash
59996890ed4d99c5c1bd7d12e3934cf1

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
2
Clean (0 engines)
62

Rule Matches

Total
Hash
Timestamp
Positives
VT
58
0474bd97cdbfdc33ffb535bf6b7353600ff81afcf5d310e2a901a69a4aa110d4
2021-09-20 07:15:46
0
58
5c90865233ce1cc3fe14461e0e08f897ef76bddf1d0add13c7f2e33a9ec9c887
2021-09-15 15:58:23
0
58
206ef36edcfe7bf853dbbd025a7f6da2971b71fe328bc3224c73acdc6ac0ee0a
2021-09-15 15:58:21
0
57
40bfe5d59f338d64444eaf040aeaa521aedd94a857cacba50b25b97269ffe5d3
2021-09-09 18:45:57
0
58
a6e1a8ae886a3b92bf80981a02f67d33346b7823c4fb386b6e3fbd7b6825dc5d
2021-09-08 22:29:43
0
57
1ed02c90cdeb7b31ae6fe8eaf8318ad7d29fdbb491c2b9afb8642565f95d572a
2021-09-08 13:59:42
0
58
cfcd9a6a9077695ea0256d6c21a0d2b7419dd5349346049e451c67c399de3107
2021-09-08 11:31:56
0
58
2eb3b1c6d56a2414d66903131b64aca20a1e2771424c1398c851f8cadeb30735
2021-09-07 21:33:54
0
58
c493d1003dfda9d3a3a7b7b7576e38bc1c2df910b5df1f4df84d12270313ae75
2021-09-07 17:56:17
0
58
6dab4574ddeeef697fc55f5fbab18440f40685f958486aaa0c3fd6b304e9d11b
2021-09-07 11:05:41
0
57
fd8eb7884ec4e0db2c38e6a1d3b27abbe5bc9ce27e48343d0906fb89e2682d8b
2021-09-07 08:13:09
0
58
ea92dbb5d6bc9706c7b1ac5b4cf10374953492392c19e8740630541ef7eb7a36
2021-09-07 06:41:44
0
57
4100e4cbdd859f021597983de63dcf35a5d63747fab3fff2e4549544b7711e3f
2021-09-07 04:22:29
0
57
74940ee8c97b958080fc5abc99182584dd6d61011ec1776f28ea6d5d8934b1d4
2021-09-06 21:50:44
0
58
9a6e14574150fb5e48be5c117353d2c1742db503c8095035eb8a95c2e9ddbadf
2021-09-06 16:34:19
0
57
cfe0ec08610c979666c59452e51c3da285faa610cf90462e1c817d361a814431
2021-09-06 16:14:10
0
57
570606b7e1e3eed01377f88a3e555b540297097d21a5718f9ab56e7e12967db8
2021-09-06 15:44:35
0
57
9d1c8a878291fdbb076ad33be59b983abc83913efcac12f22947c8e68b33c2ac
2021-09-06 15:43:20
0
58
5a7b6b42d7be997d4c5790e8a1bc614ae1302cdd089a11838d891342fb5808d5
2021-09-06 15:14:11
0
57
ab326ecff4260628a1e0f4b4d261aa6ba6037b471eff278489d775803b33118f
2021-09-06 09:09:27
0
57
04cdb3b7099795fb9a2dabec2fb424626847da2151894d61bc09fa115e2e26f2
2021-09-06 04:51:52
0
57
48dae55f099dfaf8d179d736431bb23676588c225008bb1c0aef987623be3a7c
2021-09-06 01:23:15
0
57
949fe328cd61d39ea7d3dd1084d78ca4a06d0eacd85cd832eeb18f1c7d817128
2021-09-06 00:17:00
0
55
8d77f73c1fa8f5790b9f7d90bbedee726bc394b00ed15f4ffc99248b1a0204b0
2021-09-05 22:29:40
0
56
670545150acfc3784d2d57bd3cb005fa1f8e136005a70fec4a8308e725d3e49f
2021-09-05 06:24:54
0
56
777716e2ff39fc6bed0b2ef15b6045d3335133276a8e8f930d2f23fb85b2167b
2021-09-05 06:24:54
0
55
b820d4e0e52ae82853ad5b4c07d9788abd4ff67fbbeb1f80080c70dc6b3b4424
2021-09-05 05:32:22
0
57
b09c9bd208a89326ac79efcacafb857456bc715a947b034f31295075080fe0eb
2021-09-04 23:50:12
0
56
c8000fabffddb25b499b8e11550943abcf43112e1dfcc58b53e9edaa157c5e08
2021-09-04 22:21:09
0
56
db36af5cb8c4cb4bb6e84ea5d54b4815a5ab1e95a8306122b3db1b52c3bfd270
2021-09-04 21:04:58
0
57
43aeef0a0eb15b3f632e4c50afb4345bc95119d8f5ebe3dfadd72b3f0fa97611
2021-09-04 19:45:08
0
57
e72add3489de6896fb9ce2fb935f479be6386753c569bcba1b72238c0af946fd
2021-09-04 12:17:26
0
57
05e23d7793c90b39aef364a868b12da50bfd1c777b5c6896533fa57c910befc2
2021-09-04 11:36:33
0
57
f8b045a217e723b9e52db78967076baf936fd6a4d66a2c15f60e50956f8e3e61
2021-09-04 08:08:06
0
57
c0ecb2b5a79057daf4e32aac34d329bc31e1f5a0bc9e56eca37129ff74ddaf9d
2021-09-04 07:52:56
0
57
cbe10f0d531258fc8a6362bb8ad04b7bc4a1208ec35709158d8a9ccfb92cd25c
2021-09-04 00:36:06
0
57
d8e042cd2e5e091479d6ecab7545ca3789b19e12c47d0d1bbec7c69cf46b58cc
2021-09-03 23:41:03
0
56
6d543bfffe679cdde6574035b468125d6021eb9d4293e0fab56551c07242a071
2021-09-03 19:17:04
0
57
1cf4aa974d8be52fbd0a06ad2e6e3d003c1ca47344ffc8b8d8c31bb02f455d65
2021-09-03 15:01:03
0
56
a7851ea2ca0a46b2544bd39315a347783b224eb2a679a66204249ed572d5c46a
2021-09-03 14:08:39
0
57
f6cd32c9ebdd60b65119c1348327b51ad356d360bda632cf3cafbdb68e929029
2021-09-03 14:08:38
0
57
79929dfaf5bddcdd6690a523b4ed553e386fecdbea940d791f3674c38fd3804f
2021-09-03 04:12:59
0
56
c052b8c6d09f0d045cb9822dd3770daeb7be40ec9760fd70ab475f360f94be3d
2021-09-03 03:27:25
0
51
4657e213985e926a3b4d4aaddafd0d7316193e3717155f1f83fb99fd6e3c96ba
2021-09-02 22:13:18
0
58
fca531637775d6a0fdb23131b820681e17616f860fe35c19120b159f5ac5da25
2021-09-02 14:40:16
0
58
adc99fc6dc3b4428a9bb7aee7f8f1676d181b25a706e4f43938b161033fde710
2021-09-02 11:32:42
0
58
55f2bf424d80bb1677d38b1166422a4c2902c70100b93435ad971068170c6e76
2021-09-02 11:16:08
0
57
f41172ceb3e6683cb39dcee4270dd4db09f252b5eb5a021dcd3f2f19afbfce1e
2021-09-01 20:53:11
0
58
48e4424c2a79f552c747099b4a4ea16a4e34af818fa9325c3ef605fdd38783f7
2021-09-01 20:36:04
0
58
6d2be446817d1c51f30c53d1fc56810a7d2b422a94e064de673efac3e2dbd7ba
2021-09-01 20:36:04
0
57
160823f97650027c7800d06ce7ed9def38b41345a574d1a03547bc00166d0f75
2021-09-01 19:47:57
0
58
b7ee4092fd7168fbfdfa52875a913db501a478af9d086fe53b2fd5c671af623a
2021-09-01 18:34:01
0
58
830a232381f00a4e8e370b4965da2b4e538a2bbb32e8d9b3ffda525886151a9d
2021-09-01 17:56:51
0
58
69bc84780d1ac3fba61f75a4cea0ff2167e3194e219b3d9dc95461d8ca366d2c
2021-09-01 15:30:12
0
58
4afb7ba759fa9fd5cabbc3c0b2d36fd26ff2688421eb494512a2ea444a71b0b2
2021-08-29 20:09:29
0
58
2572d30f403b24d371e80e929a16eee6785a8595230462be2984d85e9758be4e
2021-08-29 17:59:13
0
57
f0d1f3bb0917f89479c354419f6e0eaa41f7b61f0ec42689098dd1afe113a84f
2021-08-28 06:29:29
0
57
f02345bde1584e4e47ac64c975371845e938b0256e633aa11e128b2c3684f612
2021-08-27 19:50:01
0
57
a5e792aed0e6bd16dfe3d8385d9b7a88c862ed74e6d3f5819cb1e4611f98e682
2021-08-22 18:19:54
13
55
42707420af7c043de3a0f4ab1b63cb1d3f07911a1ab096d4181436d721263cf7
2021-08-22 08:57:05
0
57
b0f50b740aa9b91509b0e81035f6c2a099327df22cb2916326920236a6f5ecf7
2021-08-21 21:11:40
0
57
9308062f69dd178997a392f9781d22f870072ba05494302b639f865c0672740e
2021-08-20 15:27:42
2
58
2f7120b84a5adb3cd55ac3e75a18acf5956acda94f4c3a1002cc2bd116959db2
2021-08-18 20:07:32
2
58
2ff7160b9385b7dbbb2c5a42f8fec5c00510ea5a221634610b4aa46167e0da9a
2021-08-18 17:35:00
0
58
6e0582d2ae7ddac2a0a65e2536198919568ceed7e054be0c9c0b6631f7978942
2021-08-11 09:25:26
0

Rule Matches per Month (last 24 months)