splunk-security_content/docs/_stories/proxyshell.md

title, last_modified_at, toc, tags

title	last_modified_at	toc	tags
ProxyShell	2021-08-24	true	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Description

ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.

• ID: 413bb68e-04e2-11ec-a835-acde48001122
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-08-24
• Author: Michael Haag, Teoderick Contreras, Mauricio Velazco, Splunk

Detection profiles

Name	Technique	Type
Detect Exchange Web Shell	None	TTP
Exchange PowerShell Abuse via SSRF	None	TTP
Exchange PowerShell Module Usage	None	TTP
W3WP Spawning Shell	None	TTP

Reference

• https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
• https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
• https://www.youtube.com/watch?v=FC6iHw258RI
• https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
• https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf

source | version: 1