Potential OWASSRF Exploitation Attempt - Proxy

Status: test
Severity: high
Log source: category proxy
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Known false positives

Web vulnerability scanners

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

title: Potential OWASSRF Exploitation Attempt - Proxy
id: 1ddf4596-1908-43c9-add2-1d2c2fcc4797
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
    - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
    - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'POST'
        sc-status: 200
        c-uri|contains|all:
            - '/owa/'
            - '/powershell'
        c-uri|contains:
            - '@'
            - '%40'
    filter_main_ua:
        c-useragent:
            - 'ClientInfo'
            - 'Microsoft WinRM Client'
            - 'Exchange BackEnd Probes'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Web vulnerability scanners
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    cs-method: 'POST'
    sc-status: 200
    c-uri|contains|all:
        - '/owa/'
        - '/powershell'
    c-uri|contains:
        - '@'
        - '%40'

Stage 2: `not filter_main_ua`

filter_main_ua:
    c-useragent:
        - 'ClientInfo'
        - 'Microsoft WinRM Client'
        - 'Exchange BackEnd Probes'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`c-useragent`	eq	`ClientInfo`	`excludes:c-useragent` `field:"c-useragent" value:"ClientInfo"`
`c-useragent`	eq	`Exchange BackEnd Probes`	`excludes:c-useragent` `field:"c-useragent" value:"Exchange BackEnd Probes"`
`c-useragent`	eq	`Microsoft WinRM Client`	`excludes:c-useragent` `field:"c-useragent" value:"Microsoft WinRM Client"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	match	`%40` `/owa/` `/powershell` `@`	`field:"c-uri" kind:match`
`cs-method`	eq	`POST`	`field:"cs-method" kind:eq value:"POST"`
`sc-status`	eq	`200`	`field:"sc-status" kind:eq value:"200"`