YARA rules

Home/CVE-2021-3376/YARA rules

YARA

YARA rules for CVE-2021-3376

1 rules · scoped to cve · back to CVE-2021-3376

YARA rules whose family, name, or description matches this cve or its tooling. Use these for binary-pattern hunts.

◈

1 of 1

direct LOG

LOG_EXPL_ProxyToken_Exploitation_Aug21_1

Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system

author Florian Roth (Nextron Systems) license see source repo

view YARA rule

rule LOG_EXPL_ProxyToken_Exploitation_Aug21_1 {
   meta:
      description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
      date = "2021-08-30"
      score = 75
      id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
   strings:
      $ss0 = "POST " ascii
      $ss1 = " 500 0 0"

      $sa1 = "/ecp/" ascii
      $sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii

      $sb1 = "/ecp/" ascii
      $sb2 = "SecurityToken=" ascii
   condition:
      all of ($ss*) and ( all of ($sa*) or all of ($sb*) )
}

Showing 1-1 of 1

Prev 1 Next