On-premises Microsoft Exchange Server exposes IIS (w3wp.exe) directly to the internet for Outlook Web Access, ActiveSync, and autodiscover. ProxyLogon exploits a server-side request forgery (SSRF) in the Exchange front-end proxy to bypass authentication and make requests as the Exchange server itself, then chains a post-auth arbitrary file write to drop an ASPX web shell into the Exchange web root. From web shell to full server compromise, the attacker has SYSTEM-level access to a server that holds every email in the organization.

Zero-day exploitation by Hafnium: Microsoft attributed initial exploitation to Hafnium (China-nexus) beginning in January 2021, two months before the March 2, 2021 patch. After the patch, exploitation exploded: automated scanning and exploitation tools spread rapidly, and within a week an estimated 30,000+ Exchange servers worldwide were compromised, many by multiple threat actors simultaneously.

• CVE-2021-26855 SSRF. The ProxyLogon entry point. Unauthenticated attacker sends crafted requests to the Exchange front-end that are proxied to the backend with Exchange Server trust. Bypasses authentication entirely.
• CVE-2021-26857 Insecure deserialization in the Unified Messaging service. Allows code execution as SYSTEM when chained with 26855.
• CVE-2021-26858 Post-authentication arbitrary file write. Allows writing files to any path on the Exchange server. Used to drop web shells.
• CVE-2021-27065 Post-authentication arbitrary file write (different vector). Also used for web shell deployment. The most commonly exploited file-write in the chain.

1. 1. Scan Exchange web directories for web shells Search for unexpected .aspx, .ashx, and .asmx files in: C:\inetpub\wwwrootspnet_client\, Exchange FrontEnd\HttpProxy\owauth\, and any other IIS virtual directory. Known web shell names from ProxyLogon campaigns: web.aspx, help.aspx, document.aspx, errorEE.aspx, errorEEE.aspx, errorEW.aspx, and China Chopper variants. Any .aspx file not in the Exchange installation baseline is suspicious. PowerShell: Get-ChildItem -Recurse -Include *.aspx | Where LastWriteTime -gt [date]
2. 2. Check IIS logs for SSRF exploitation patterns Search IIS logs for POST requests to /ecp/ containing the X-BEResource cookie with internal hostnames or IPs, and /owa/auth/ requests with anomalous parameters. HTTP 200 responses to /ecp/ endpoints from external IPs that bypass authentication indicate successful SSRF exploitation. IIS logs: %SystemDrive%\inetpub\logs\LogFiles · POST to /ecp/ with X-BEResource
3. 3. Hunt for w3wp.exe child processes Same detection pattern as the SharePoint CVE Chain: the Exchange worker process (w3wp.exe running under the Exchange application pool) spawning cmd.exe, powershell.exe, net.exe, whoami.exe, or any reconnaissance tool indicates web shell activity or direct RCE. Sysmon EID 1: ParentImage contains w3wp.exe · HOST: Execution
4. 4. Check for credential theft post-compromise Exchange servers hold domain credentials in memory (LSASS) and often have Domain Admin service accounts. After web shell deployment, attackers dump LSASS, run Mimikatz, or perform DCSync. Check for: procdump.exe, comsvcs.dll MiniDump, and credential access indicators. HOST: T1003.001 LSASS · T1003.003 NTDS.dit
5. 5. Audit the entire ProxyShell/ProxyNotShell family If your Exchange server was vulnerable to ProxyLogon, it may also have been vulnerable to ProxyShell (CVE-2021-34473/34523/31207) and ProxyNotShell (CVE-2022-41040/41082). Check the installed Exchange CU and SU against each CVE. Multiple exploitation waves hit the same architectural weakness. Microsoft Exchange Server build numbers · Get-ExchangeServer | fl AdminDisplayVersion
6. 6. If compromised: assume full email access and domain credential exposure An attacker with a web shell on Exchange has access to every mailbox in the organization and every credential cached on the server. Scope accordingly: full email audit for data access, LSASS dump check, lateral movement trace, and domain compromise assessment. BEC playbook · Compromised Credentials playbook

Hafnium (China-nexus, Microsoft designation): zero-day exploitation from January 2021, two months before disclosure.
Multiple nation-state actors exploited within days of the March 2 patch, including APT groups from China, Iran, and Russia.
Ransomware operators (DearCry, Black Kingdom) began deploying ransomware via ProxyLogon web shells within the first week.
Commodity actors deployed cryptominers, botnets, and additional web shells at scale. Many servers were compromised by multiple actors simultaneously.

SharePoint CVE Chain (same w3wp.exe exploitation pattern, same web shell detection methods)
Edge Device Compromised (Exchange is an internet-facing application server)
Business Email Compromise (full mailbox access is the immediate consequence)
Compromised Credentials (Exchange servers cache domain credentials)