CVE-2020-0688 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects exploitation attempts targeting CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. The rule specifically looks for requests to '/ecp/default.aspx' containing '__VIEWSTATEGENERATOR=' and '__VIEWSTATE=' in the query string, which are indicators of the exploit.