Emerging Threathightest

Exchange Exploitation Used by HAFNIUM

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Wed Mar 03Updated Mon Jan 0267bce556-312f-4c81-9162-c3c9ff2599b22021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_1:
        cs-method: 'POST'
        cs-uri-query|contains: '/owa/auth/Current/themes/resources/'
    selection_2:
        cs-method: 'POST'
        cs-uri-query|contains: '/owa/auth/Current/'
        cs-user-agent:
            - 'DuckDuckBot/1.0;+(+http://duckduckgo.com/duckduckbot.html)'
            - 'facebookexternalhit/1.1+(+http://www.facebook.com/externalhit_uatext.php)'
            - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
            - 'Mozilla/5.0+(compatible;+Bingbot/2.0;++http://www.bing.com/bingbot.htm)'
            - 'Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html'
            - 'Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)'
            - 'Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)'
            - 'Mozilla/5.0+(compatible;+YandexBot/3.0;++http://yandex.com/bots)'
            - 'Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36'
    selection_3:
        cs-uri-query|contains: '/ecp/'
        cs-method: 'POST'
        cs-user-agent:
            - 'ExchangeServicesClient/0.0.0.0'
            - 'python-requests/2.19.1'
            - 'python-requests/2.25.1'
    selection_4:
        cs-uri-query|contains:
            - '/aspnet_client/'
            - '/owa/'
        cs-method: 'POST'
        cs-user-agent:
            - 'antSword/v2.1'
            - 'Googlebot/2.1+(+http://www.googlebot.com/bot.html)'
            - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
    selection_5:
        cs-uri-query|contains:
            - '/owa/auth/Current/'
            - '/ecp/default.flt'
            - '/ecp/main.css'
        cs-method: 'POST'
    selection_6:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/ecp/'
            - '.js'
    condition: 1 of selection_*