Detection rules › Sigma
Potential OWASSRF Exploitation Attempt - Proxy
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
Rule body yaml
title: Potential OWASSRF Exploitation Attempt - Proxy
id: 1ddf4596-1908-43c9-add2-1d2c2fcc4797
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
- https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: 'POST'
sc-status: 200
c-uri|contains|all:
- '/owa/'
- '/powershell'
c-uri|contains:
- '@'
- '%40'
filter_main_ua:
c-useragent:
- 'ClientInfo'
- 'Microsoft WinRM Client'
- 'Exchange BackEnd Probes'
condition: selection and not 1 of filter_main_*
falsepositives:
- Web vulnerability scanners
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
cs-method: 'POST'
sc-status: 200
c-uri|contains|all:
- '/owa/'
- '/powershell'
c-uri|contains:
- '@'
- '%40'
Stage 2: not filter_main_ua
filter_main_ua:
c-useragent:
- 'ClientInfo'
- 'Microsoft WinRM Client'
- 'Exchange BackEnd Probes'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
c-useragent | eq | ClientInfo |
c-useragent | eq | Exchange BackEnd Probes |
c-useragent | eq | Microsoft WinRM Client |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.