Would your org have caught ProxyLogon? A detection checklist

ProxyLogon was a chain of Microsoft Exchange Server flaws exploited in early 2021 that let an unauthenticated attacker run code on on-premises servers. You would have caught it if you knew every Exchange server you exposed, patched out of band within days, and reviewed web logs and file paths for web shells. This checklist tests each piece.

What happened, in plain terms?

CISA's advisory AA21-062A, first issued on 3 March 2021, describes active exploitation of four vulnerabilities. CVE-2021-26855 is a server-side request forgery in the Exchange Control Panel that lets an attacker authenticate as the Exchange server. CVE-2021-26857 is an insecure deserialization flaw in the Unified Messaging service that allows code execution as SYSTEM. CVE-2021-26858 and CVE-2021-27065 are post-authentication arbitrary file write flaws.

Microsoft released patches out of band. The flaws affected on-premises Exchange only, not Exchange Online or Microsoft 365. CISA observed web shells, including China Chopper variants, and noted that ransomware called DearCry was seen exploiting compromised servers in March 2021. A July 2021 update attributed the activity to actors affiliated with the PRC Ministry of State Security.

No blame applies to the organizations affected. An exposed mail server is a normal business choice. The test is how quickly you could have known and acted.

The checklist

Know what you run

• Do you have a list of every on-premises Exchange server, with version and cumulative update level?
• Do you know which of them were reachable from the internet, and on which paths? CISA's guidance named /owa/ and /ecp/.
• Is an end-of-support Exchange build still alive anywhere?

Patch fast, out of band

• Could you apply an emergency patch in days, not at the next monthly window? CISA required specific cumulative updates before the patch would install, so also ask: how far behind on updates are you?
• Do you have a documented way to apply a vendor's temporary mitigation when you cannot patch right away?
• Can you disconnect a server from the internet when the risk is high? CISA lists that as an option.

Detect compromise

• Do you keep IIS and Exchange logs long enough to look back? CISA advised investigating activity from at least 1 January 2021.
• Can you search for unexpected .aspx files in the Exchange FrontEnd HttpProxy and aspnet_client directories?
• Can you review web logs for suspicious POST requests to /owa/auth/Current/ and /ecp/, and for unusual user agents?
• Do you know how to run Microsoft's published detection script, and who would?
• Do your tools alert when a web server process starts unusual child processes?

Respond

• If you find a web shell, is "assume identity compromise" your documented first position, as CISA recommends?
• Do you know how to collect memory, event logs and web logs before cleaning up?
• Do you know who to report to if ransomware appears?

How do you read the result?

A shortfall in "know what you run" is the most common and the most serious, because everything else depends on it. Patching speed is next. Detection gaps explain why many organizations learned weeks later that they had been compromised before they patched. Patching closes the door but does not remove an attacker who already entered, which is why the detection questions matter.

Is this only about Exchange?

No. The pattern repeats for any internet-facing system: unknown inventory, slow emergency patching, and no way to look backwards. Software supply chain tooling helps with the first one for software you build or ship, since an SBOM and a findings history answer "where do we run this component." It does not replace patching a vendor product you operate.

What to do

1. Build or update the inventory of internet-facing servers and their patch levels.
2. Write an emergency patch procedure with an owner and a target time.
3. Keep web and server logs for at least a year if you can afford it.
4. Rehearse a web shell hunt on a test server.
5. Decide in advance who may take a server offline.

Quick check

Sources

• CISA, Alert AA21-062A, Mitigate Microsoft Exchange Server Vulnerabilities
• NVD, CVE-2021-26855

Last reviewed: 18 October 2026.