Sigma rule: Potential OWASSRF Exploitation Attempt - Webserver

Rule

Title

Potential OWASSRF Exploitation Attempt - Webserver

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-22

Modified

2023-01-02

File

rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Log source

category

webserver

Detection

selection:
    cs-method: 'POST'
    sc-status: 200
    cs-uri-query|contains|all:
        - '/owa/'
        - '/powershell'
    cs-uri-query|contains:
        - '@'
        - '%40'
filter_main_ua:
    cs-user-agent:
        - 'ClientInfo'
        - 'Microsoft WinRM Client'
        - 'Exchange BackEnd Probes'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Web vulnerability scanners

Tags

• attack.initial-access
• attack.t1190
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
• https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml