OWASSRF Exploitation Attempt on Exchange Server via Proxy

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•26

Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This exploit leverages the Outlook Web Access (OWA) endpoint to gain access to the PowerShell backend endpoint, indicated by specific URI patterns, HTTP method, user-agent, and a successful HTTP status code.