Exchange Certificate Export Writes CSR to Web Server Paths or .aspx Suffixes

title: Exchange Certificate Export Writes CSR to Web Server Paths or .aspx Suffixes
id: 4b81c2c9-9221-42de-9b6e-8976de1e2382
status: test
description: This rule identifies Exchange management activity that generates a certificate signing request (CSR) and writes it to atypical destinations, such as local admin shares and web-root paths, including filenames ending in .aspx. Attackers may use this to place malicious content in web-accessible locations, enabling persistence through webshell-like files. The detection relies on process/service telemetry from msexchange-management that captures the certificate export command text and its parameters.
references:
  - https://twitter.com/GossiTheDog/status/1429175908905127938
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2023-01-23
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  service: msexchange-management
  product: windows
detection:
  keywords_export_command:
    "|all":
      - New-ExchangeCertificate
      - " -GenerateRequest"
      - " -BinaryEncoded"
      - " -RequestFile"
  keywords_export_params:
    - \\\\localhost\\C$
    - \\\\127.0.0.1\\C$
    - C:\\inetpub
    - .aspx
  condition: keywords_export_command and keywords_export_params
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: b7bc7038-638b-4ffd-880c-292c692209ef
    type: derived