Sigma rule: OWASSRF Exploitation Attempt Using Public POC - Proxy

Rule

Title

OWASSRF Exploitation Attempt Using Public POC - Proxy

Status

test

Level

critical

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-22

File

rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_poc_exploitation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Log source

category

proxy

Detection

selection:
    # Look for the header: X-OWA-ExplicitLogonUser: owa/[email protected]
    c-useragent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36'
    cs-method: 'POST'
    sc-status: 200
    c-uri|contains|all:
        - '/owa/mastermailbox'
        - '/powershell'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.initial-access
• attack.t1190
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
• https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
• https://twitter.com/purp1ew0lf/status/1602989967776808961?s=12&t=OkZJl_ViICeiftVEsohRyw

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_poc_exploitation.yml