Potential OWASSRF Exploitation Attempt via Proxy

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•2•0•44

Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.