Sigma rule: Exchange Set OabVirtualDirectory ExternalUrl Property

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-863d77b37f28, updated 2023-01-23T00:00:00.000Z.

Rule

Title
Exchange Set OabVirtualDirectory ExternalUrl Property
Status
test
Level
high
Author
Jose Rodriguez @Cyb3rPandaH
Date
2021-03-15
Modified
2023-01-23
File
rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Log source

product
windows
service
msexchange-management

Detection

keywords:
    '|all':
        - 'Set-OabVirtualDirectory'
        - 'ExternalUrl'
        - 'Page_Load'
        - 'script'
condition: keywords

False positives (as the rule lists them)

  • Unknown

Tags

  • attack.persistence
  • attack.t1505.003

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml

Sources and licences

  • SigmaHQ

    "Exchange Set OabVirtualDirectory ExternalUrl Property" by Jose Rodriguez @Cyb3rPandaH (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Exchange Set OabVirtualDirectory ExternalUrl Property",
entity page, dataset version ref-863d77b37f28, updated 2023-01-23T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/9db37458-4df2-46a5-95ab-307e7f29e675 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 9db37458-4df2-46a5-95ab-307e7f29e675, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.