""ET EXPLOIT Microsoft Exchange Server Exploitation Inbound (CVE-2020-17132)""

SID: 2031506

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Server, created_at 2021_01_08, cve CVE_2020_17132, deployment Perimeter, deployment Internal, signature_severity Major, updated_at 2021_01_08

Reference:

  • cve

  • 2020-17132

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HTTP_SERVERS,$HOME_NET]

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

  • Value: "POST"

  • Value: "/ecp/DLPPolicy/ManagePolicyFromISV.aspx" Depth: 39

  • Value: "ctl00$ResultPanePlaceHolder$contentContainer$upldCtrl"

  • Value: "[Diagnostics.Process]::start|28|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_client_body

  • http_client_body

source