Potential OWASSRF Exploitation Attempt on Exchange Webserver

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This exploit leverages the OWA endpoint to access the PowerShell backend endpoint, often associated with CVE-2022-41080 and CVE-2022-41082.