Detection rules › Sigma
Potential OWASSRF Exploitation Attempt - Webserver
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
Rule body yaml
title: Potential OWASSRF Exploitation Attempt - Webserver
id: 181f49fa-0b21-4665-a98c-a57025ebb8c7
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
- https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
sc-status: 200
cs-uri-query|contains|all:
- '/owa/'
- '/powershell'
cs-uri-query|contains:
- '@'
- '%40'
filter_main_ua:
cs-user-agent:
- 'ClientInfo'
- 'Microsoft WinRM Client'
- 'Exchange BackEnd Probes'
condition: selection and not 1 of filter_main_*
falsepositives:
- Web vulnerability scanners
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
cs-method: 'POST'
sc-status: 200
cs-uri-query|contains|all:
- '/owa/'
- '/powershell'
cs-uri-query|contains:
- '@'
- '%40'
Stage 2: not filter_main_ua
filter_main_ua:
cs-user-agent:
- 'ClientInfo'
- 'Microsoft WinRM Client'
- 'Exchange BackEnd Probes'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
cs-user-agent | eq | ClientInfo |
cs-user-agent | eq | Exchange BackEnd Probes |
cs-user-agent | eq | Microsoft WinRM Client |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
cs-method | eq |
|
cs-uri-query | match |
|
sc-status | eq |
|