""ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)""

SID: 2043002

Revision: 1

Class Type: attempted-admin

Metadata: affected_product Microsoft_Exchange, attack_target Server, created_at 2022_12_23, cve CVE_2022_41040_CVE_2022_41082, deployment Perimeter, deployment SSLDecrypt, signature_severity Major, tag ProxyNotShell, updated_at 2022_12_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

  • cve

  • 2022-41082

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/owa/" Depth: 5

  • Value: "@"

  • Value: "/powershell"

  • Value: !"User-Agent|3a 20|ClientInfo|0d 0a|"

  • Value: !"User-Agent|3a 20|Microsoft WinRM Client|0d 0a|"

  • Value: !"User-Agent|3a 20|Exchange BackEnd Probes|0d 0a|"

  • Value: "|3c|s|3a|Envelope|20|xmlns|3a|rsp|3d 22|" Depth: 23

  • Value: "wbem/wsman/1/windows/shell|22|"

  • Value: "|3c|wsa|3a|To|3e|"

  • Value: "|3c|s|3a|Body|3e 3c|rsp|3a|Shell|20|ShellId|3d 22|"

Within: 100

PCRE: "/\/powershell$/Ui"

Special Options:

  • http_method

  • http_uri

  • nocase

  • http_uri

  • http_uri

  • nocase

  • fast_pattern

  • http_header

  • http_header

  • http_header

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

source