Exchange Set OabVirtualDirectory ExternalUrl Property with Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.