Watch for unblocked autodiscover and PowerShell request patterns, remote PowerShell still enabled for non-admin users, and outbound Exchange connections that are not tightly allowlisted. If encrypted traffic is never inspected, malicious payloads and encoded variants can also pass unnoticed. Those gaps usually mean the control stack is relying on a single defense instead of layered detection and blocking.
How to tell the mitigation stack is still missing a ProxyNotShell path
Incomplete coverage usually shows up when one part of the Exchange attack path is being blocked while the rest remains viable. If autodiscover requests still reach the server, remote PowerShell is still available to more users than intended, or outbound Exchange traffic is broadly permitted, the exposure is not closed. The point is not whether one alert fires, but whether the whole request, execution, and egress chain is constrained.
Another warning sign is when the controls look selective rather than layered. A single filter that catches one payload style will not help if encoded variants, alternate request shapes, or decrypted content are still passing through to Exchange. That is especially true when the mitigation depends on one inspection point instead of consistent blocking at multiple boundaries.
Incomplete coverage also tends to leave a mismatch between policy and actual reachability. If a mitigation says remote management is restricted, but non-admin paths still work, or if an outbound allowlist exists in name only, the environment is still testable by an attacker. Coverage is incomplete when the defender can describe the control, but cannot show that the path is truly denied in practice.
Where ProxyNotShell defenses usually fail in practice
The common failure mode is partial hardening. Exchange exposure can remain through permissive autodiscover behavior, lingering PowerShell exposure, and network egress rules that are too loose to stop callback or staging traffic. Those weaknesses matter because they let an attacker move from initial request handling into post-exploitation activity without needing every layer to fail at once.
Encrypted traffic is another practical blind spot. If TLS is never inspected, the control stack may only see metadata, not the content or encoded payload that matters for exploitation. That creates an observation gap: defenders may believe the perimeter is clean while the malicious request is simply hidden from the tools doing the checking.
For a useful internal reference on how exposure and secret-bearing paths become exploitable, see The 52 NHI Breaches Report, which is a strong example of how a weak control layer can fail to stop abuse once credentials or access paths are in play. The same defensive lesson applies here: single-point protections rarely hold up against a layered attack path.
What a complete Exchange mitigation posture should actually prove
A complete posture should prove three things at once: unwanted request patterns are blocked, management surfaces are reduced to the minimum necessary, and outbound channels are constrained tightly enough that compromise cannot easily phone home. If any one of those is missing, the defender may have reduced risk without actually shutting the door.
That proof should be observable, not assumed. Practitioners should verify that detection coverage matches the request surface, that policy enforcement is not bypassed by alternate paths, and that outbound traffic is reviewed against a strict allowlist rather than broad internet reachability. If the control only works when Exchange behaves exactly as expected, it is not robust enough for exposure management.
For operational context on security response and exposure triage, CISA cyber threat advisories remain useful for tracking known exploitation patterns and defensive actions. For a broader control lens, NIST Cybersecurity Framework 2.0 is helpful when you need to connect protection, detection, and response into one defensible posture.
Risk and Threat Considerations
When Exchange mitigation is incomplete, the risk is not just residual exposure, it is compound exposure. An attacker can chain a weak request filter, an open management path, and permissive egress into a reliable foothold, then use encoded or encrypted traffic to reduce visibility. That makes the environment easier to probe, easier to persist in, and harder to prove clean.
Failure mechanism: One control blocks a known pattern, but alternate request forms, exposed PowerShell access, or uninspected encrypted traffic still allow exploitation or follow-on activity.
Impact: Organizations can miss active compromise, fail to contain attacker movement, and keep a vulnerable Exchange surface reachable even after believing mitigation is in place.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | ProxyNotShell is a public-facing Exchange exploitation path. |
| T1021.006 — Remote Services: Windows Remote Management | Remote PowerShell access reflects remote service abuse and lateral movement potential. | |
| Recommendation — Map Exchange exposure to T1190 and validate internet-facing request-blocking coverage. Restrict remote management paths and monitor for unauthorized PowerShell access. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Incomplete mitigation often means perimeter and egress controls are too loose. |
| AC-17 — Remote Access | Remote PowerShell and admin reachability are central to the exposure check. | |
| SI-4 — System Monitoring | The question centers on missed request patterns and hidden malicious traffic. | |
| Recommendation — Enforce boundary restrictions that limit inbound abuse and outbound callback traffic. Limit remote administrative access to approved users and tightly controlled channels. Monitor Exchange request and traffic patterns for exploitation indicators and anomalies. | ||
Practitioner Guidance
What to verify: Test the exact surfaces that ProxyNotShell uses, including autodiscover reachability, remote PowerShell exposure, and outbound Exchange connectivity. A configuration is only credible when the denied path stays denied under realistic request variations and cannot be reopened by a different network route.
Decision rule: If you can only point to one blocking layer, treat the mitigation as incomplete until you can show both request-side blocking and egress restriction. If encrypted traffic cannot be inspected, assume your visibility is partial and prioritize compensating detection around request anomalies and management access.
Practitioner takeaway: For Exchange exposure, completeness is judged by whether the entire exploit chain is constrained, not whether any single control appears to be working.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
