Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2022-41080 ProxyNotShell Exchange PowerShell Endpoint Access
id: 96904cc4-408a-49a7-b3b9-0e8435c082da
date: 2026-08-15
status: experimental
description: |
Detects exploitation attempts of CVE-2022-41080 (ProxyNotShell) targeting Microsoft Exchange Server.
CVE-2022-41080 is an Elevation of Privilege vulnerability that allows an authenticated attacker to bypass authentication on the /powershell/ endpoint.
CVSS: 8.8 | KEV Status: Listed by CISA.
This rule looks for HTTP requests to the Exchange PowerShell endpoint combined with suspicious cmdlet execution or unusual client User-Agents.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2022-41080
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.microsoft.com/en-us/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
author: SARA Detection Engineering
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059.001
- attack.privilege_escalation
- attack.t1068
logsource:
category: proxy
detection:
selection_endpoint:
cs-method: POST
cs-uri-stem|contains|all:
- "/powershell/"
- "X-Rps-CAT"
selection_suspicious_ua:
c-user-agent|contains:
- "python-requests/"
- "curl/"
- "Go-http-client/"
- "PowerShell-HttpClient"
- "Mozilla/5.0"
filter_legitimate_ua:
c-user-agent|contains:
- "MSWinHttp"
- "WinRM"
condition: selection_endpoint and (selection_suspicious_ua or not filter_legitimate_ua)
fields:
- c-ip
- cs-host
- cs-method
- cs-uri-stem
- cs-user-agent
- sc-status
falsepositives:
- Legitimate Exchange administrative tasks performed via remote PowerShell (e.g., compliance searches). Validate the source IP and user context.
- Third-party Exchange monitoring or backup solutions that interact with the PowerShell endpoint. Verify the User-Agent and source IP against known management servers.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →