Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,731
Ready to search
Backends
17
Loaded from pysigma-node
pySigma Versions
10
Newest: 1.3.3
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Potential OWASSRF Exploitation Attempt - Proxy
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Conversion Output
Potential OWASSRF Exploitation Attempt - Proxy
Using Splunk · Default · pySigma 1.3.3
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion1.3.3
title: Potential OWASSRF Exploitation Attempt - Proxy
id: 1ddf4596-1908-43c9-add2-1d2c2fcc4797
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
- https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: 'POST'
sc-status: 200
c-uri|contains|all:
- '/owa/'
- '/powershell'
c-uri|contains:
- '@'
- '%40'
filter_main_ua:
c-useragent:
- 'ClientInfo'
- 'Microsoft WinRM Client'
- 'Exchange BackEnd Probes'
condition: selection and not 1 of filter_main_*
falsepositives:
- Web vulnerability scanners
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_exploitation.yml