ProxyLogon Reset Virtual Directories Based On IIS Log — Detection Rule

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

Read the full analysis on IntelFusions