detection.wiki

Detection rules › Sigma

CVE-2020-0688 Exploitation via Eventlog

Status
test
Severity
high
Log source
product windows, service application
Author
Florian Roth (Nextron Systems), wagga
Source
github.com/SigmaHQ/sigma

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Telemetry coverage

ProviderRecord / event type
MSExchange-Control-PanelEvent ID 4: The Exchange Control Panel web application encountered an unhandled ASP.NET exception.

Rule body

title: CVE-2020-0688 Exploitation via Eventlog
id: d6266bf5-935e-4661-b477-78772735a7cb
status: test
description: Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688
references:
    - https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/
    - https://cyberpolygon.com/materials/okhota-na-ataki-ms-exchange-chast-2-cve-2020-0688-cve-2020-16875-cve-2021-24085/
author: Florian Roth (Nextron Systems), wagga
date: 2020-02-29
modified: 2022-12-25
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2020-0688
    - detection.emerging-threats
logsource:
    product: windows
    service: application
detection:
    selection1:
        EventID: 4
        Provider_Name: 'MSExchange Control Panel'
        Level: Error
    selection2:
        - '&__VIEWSTATE='
    condition: all of selection*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection*

Stage 1: selection1

selection1:
    EventID: 4
    Provider_Name: 'MSExchange Control Panel'
    Level: Error

Stage 2: selection2

selection2:
    - '&__VIEWSTATE='

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Leveleq
  • Error
field:"Level" kind:eq value:"Error"
Provider_Nameeq
  • MSExchange Control Panel
field:"Provider_Name" kind:eq value:"MSExchange Control Panel"