Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
This rule detects attempts to export an Exchange Certificate Signing Request (CSR) to an unusual directory or with an .aspx file extension. This activity is suspicious because it could indicate an adversary attempting to place a webshell on an Exchange web server for persistent access. The rule specifically looks for the PowerShell cmdlet 'New-ExchangeCertificate' with parameters '-GenerateRequest', '-BinaryEncoded', and '-RequestFile', combined with suspicious file paths like '\\localhost\C$', '\\127.0.0.1\C$', 'C:\inetpub', or the '.aspx' extension.
This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.
Detects the deletion of Exchange PowerShell cmdlet history logs, which may indicate an attempt by an adversary to destroy forensic evidence and evade detection. This action can hinder incident response and forensic analysis.
Detects the creation of suspicious web shell files (ASPX, ASP, ASHX) by the IIS worker process (w3wp.exe) in directories commonly associated with Microsoft Exchange or IIS web roots. This activity is indicative of potential exploitation of Exchange vulnerabilities, such as those used in the ProxyShell or ProxyNotShell attacks, to establish persistence via web shells.
Detects URL patterns indicative of ProxyShell exploitation attempts against Microsoft Exchange servers. The rule looks for specific URI query strings and HTTP status codes (401) that are characteristic of both failed and successful exploitation attempts.
Detects URL patterns and status codes that indicate a successful ProxyShell exploitation attack against Microsoft Exchange servers. The rule looks for requests to '/autodiscover.json' combined with specific URI paths like '/powershell', '/mapi/nspi', or '/EWS', and successful HTTP status codes (200 or 301).
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.
Detects the exploitation of the Microsoft Exchange ProxyToken vulnerability (CVE-2021-33766), which is an authentication bypass. The rule looks for specific URI query patterns and HTTP POST methods combined with a 500 HTTP status code, indicating a potential exploitation attempt against the Exchange Control Panel (ECP) or related services.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share, which has been observed in ProxyShell exploitation scenarios. This activity indicates an attempt to exfiltrate mailbox data.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share. This activity has been observed in ProxyShell exploitation scenarios, where attackers exfiltrate mailbox data. The rule specifically looks for the cmdlet name, the `-Mailbox` parameter, and the `-FilePath` parameter followed by a UNC path (indicating a share).
Detects the installation of a Microsoft Exchange Transport Agent by monitoring for the 'Install-TransportAgent' command-line argument. This activity can be used by adversaries to establish persistence on Exchange servers.
Detects the addition of a new Federated Domain.
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Detects suspicious file type dropped by an Exchange component in IIS
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Page 26 of 26