ProxyShell CVE-2021-34473 Exchange Autodiscover Path Traversal

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.