Suspected ProxyToken Exploitation

id: 141a3be6-be08-4519-9698-2fc908f6761c
name: Suspected ProxyToken Exploitation
description: |
  'Looks for activity that might indicate exploitation of the ProxyToken vulnerability - CVE-2021-33766
  Ref: https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server'
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  W3CIISLog
  //Exclude local addresses, using the ipv4_is_private operator
  | where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
  | where csMethod =~ "POST"
  | where csUriStem has "/ecp"
  | where isnotempty(csCookie) and csCookie has "SecurityToken"
  | where csUriQuery has "msExchEcpCanary"
  | extend timestamp=TimeGenerated, HostCustomEntity=Computer, IPCustomEntity=cIP
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: cIP