ProxyLogon Post-Exploitation via Set-OabVirtualDirectory
This rule detects specific patterns indicative of successful ProxyLogon exploitation targeting Microsoft Exchange's OabVirtualDirectory. It looks for the invocation of the 'Set-OabVirtualDirectory' cmdlet in conjunction with suspicious parameters often used in post-exploitation activities, such as injecting web shell code ('eval(request'), or manipulating the ExternalUrl with malicious scripts ('http://f/<script', '"unsafe"};', 'function Page_Load()'). This combination suggests an attacker has successfully leveraged the ProxyLogon vulnerabilities to execute arbitrary commands and modify Exchange configurations for persistence or further access.
Sigma
