Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
4
3
1
Platforms
4
Products / Services
4
2
2
2
2
MITRE Techniques
4
4
CVEs
71
71
64
58
49
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This exploit leverages the Outlook Web Access (OWA) endpoint to gain access to the PowerShell backend endpoint, indicated by specific URI patterns, HTTP method, user-agent, and a successful HTTP status code.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This rule specifically looks for requests to the OWA endpoint attempting to access the PowerShell backend endpoint, characterized by a specific user agent, POST method, successful status code (200), and URI query containing both '/owa/mastermailbox' and '/powershell'. This indicates an attempt to leverage the vulnerability for remote code execution.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This exploit leverages the OWA endpoint to access the PowerShell backend endpoint, often associated with CVE-2022-41080 and CVE-2022-41082.