Sigma rule: Exchange Exploitation Used by HAFNIUM

Rule

Title

Exchange Exploitation Used by HAFNIUM

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2021-03-03

Modified

2023-01-02

File

rules-emerging-threats/2021/TA/HAFNIUM/web_exchange_exploitation_hafnium.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Log source

category

webserver

Detection

selection_1:
    cs-method: 'POST'
    cs-uri-query|contains: '/owa/auth/Current/themes/resources/'
selection_2:
    cs-method: 'POST'
    cs-uri-query|contains: '/owa/auth/Current/'
    cs-user-agent:
        - 'DuckDuckBot/1.0;+(+http://duckduckgo.com/duckduckbot.html)'
        - 'facebookexternalhit/1.1+(+http://www.facebook.com/externalhit_uatext.php)'
        - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
        - 'Mozilla/5.0+(compatible;+Bingbot/2.0;++http://www.bing.com/bingbot.htm)'
        - 'Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html'
        - 'Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)'
        - 'Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)'
        - 'Mozilla/5.0+(compatible;+YandexBot/3.0;++http://yandex.com/bots)'
        - 'Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36'
selection_3:
    cs-uri-query|contains: '/ecp/'
    cs-method: 'POST'
    cs-user-agent:
        - 'ExchangeServicesClient/0.0.0.0'
        - 'python-requests/2.19.1'
        - 'python-requests/2.25.1'
selection_4:
    cs-uri-query|contains:
        - '/aspnet_client/'
        - '/owa/'
    cs-method: 'POST'
    cs-user-agent:
        - 'antSword/v2.1'
        - 'Googlebot/2.1+(+http://www.googlebot.com/bot.html)'
        - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
selection_5:
    cs-uri-query|contains:
        - '/owa/auth/Current/'
        - '/ecp/default.flt'
        - '/ecp/main.css'
    cs-method: 'POST'
selection_6:
    cs-method: 'POST'
    cs-uri-query|contains|all:
        - '/ecp/'
        - '.js'
condition: 1 of selection_*

False positives (as the rule lists them)

• Legitimate access to other web applications that use the same folder names as Exchange (e.g. owa, ecp) but are not Microsoft Exchange related

Tags

• attack.initial-access
• attack.t1190
• attack.g0125
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• G0125
• T1190

References

• https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
• https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/TA/HAFNIUM/web_exchange_exploitation_hafnium.yml