Vuln: CVE-2021-26858 | Detection.FYI

Microsoft Exchange Server UM Writing Suspicious Files

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Tactic: Lateral Movement Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend Data Source: Sysmon Data Source: Microsoft Defender XDR Data Source: SentinelOne Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Web Shell Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Vuln: CVE-2021-26858 ·
Share on:

Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.

Read More