CVE-2026-42897 OWA XSS Exploitation Achieving Mailbox Code Execution
Detects malicious script execution triggered by the CVE-2026-42897 XSS vulnerability in Outlook Web Access (OWA). The detection rule monitors AMSI script detection events for patterns associated with the OWAReaper exploit chain, which utilizes an 'onload=eval(atob())' loader to reconstruct a base64-encoded payload embedded in social-icon image tags within a browser session.
Microsoft Sentinel (KQL)
