Detection rules › Splunk
Exchange PowerShell Abuse via SSRF
The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to autodiscover.json containing PowerShell in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1133 External Remote Services, T1190 Exploit Public-Facing Application |
| Persistence | T1133 External Remote Services |
Rule body splunk
name: Exchange PowerShell Abuse via SSRF
id: 29228ab4-0762-11ec-94aa-acde48001122
version: 11
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
data_source: []
search: |-
`windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest, cs_uri_query, cs_method,
c_uri
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `exchange_powershell_abuse_via_ssrf_filter`
how_to_implement: The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
known_false_positives: Limited false positives, however, tune as needed.
references:
- https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF
- https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
finding:
title: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
entity:
field: dest
type: system
score: 50
analytic_story:
- ProxyShell
- BlackByte Ransomware
- ProxyNotShell
- Seashell Blizzard
asset_type: Endpoint
mitre_attack_id:
- T1190
- T1133
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest, cs_uri_query, cs_method,
c_uri
Stage 3: search
| `security_content_ctime(firstTime)`
Stage 4: search
| `security_content_ctime(lastTime)`
Stage 5: search
| `exchange_powershell_abuse_via_ssrf_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
c_uri | eq |
|
cs_method | eq |
|
cs_uri_query | eq |
|
sourcetype | in |
|