Microsoft Exchange ProxyNotShell Exploit

Rule Info

Tags
attack.execution
Modified
None
Author
pH-T
Name
Microsoft Exchange ProxyNotShell Exploit
Description
Detects Microsoft Exchange exploit for CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)
Date
2022-11-17 00:00:00
Reference
https://github.com/testanull/ProxyNotShell-PoC
Id
df23d4fb-b12b-4425-a340-8d59e2460c43
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022