Coverage › CVE-2021-26857

CVE-2021-26857 Mapped Sigma

Microsoft Exchange Server Remote Code Execution Vulnerability

Vendor / product

Microsoft — Exchange Server

Description (CISA)

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-502

CISA notes

Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26857

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1133 External Remote Services secondary impact

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →

T1505.003 Web Shell primary impact

• DET0394 Web Shell Detection via Server Behavior and File Execution Chains
  AN1108 Windows

  Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

  Tunable: WebRootPath ParentProcess
  AN1109 Linux

  File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

  auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation

  auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation

  NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

  Tunable: WebRootPath PayloadEntropyThreshold TimeWindow
  AN1110 macOS

  Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

  macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation

  auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

  Tunable: InterpreterName ExecutionParent

Sigma rules tagged attack.t1505.003 (35)

All 35 rules on the technique page →

Sigma rules tagged with this CVE directly

1 rule carries cve.2021-26857.