Emerging Threathightest

Potential OWASSRF Exploitation Attempt - Proxy

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Dec 221ddf4596-1908-43c9-add2-1d2c2fcc47972022

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        cs-method: 'POST'
        sc-status: 200
        c-uri|contains|all:
            - '/owa/'
            - '/powershell'
        c-uri|contains:
            - '@'
            - '%40'
    filter_main_ua:
        c-useragent:
            - 'ClientInfo'
            - 'Microsoft WinRM Client'
            - 'Exchange BackEnd Probes'
    condition: selection and not 1 of filter_main_*