Exchange Management: Certificate CSR exported to webserver or .aspx-named path
Flags Exchange CSR export commands that write request files to C$ and web-root paths or use an .aspx filename.
- Product
- windows
- Service
- msexchange-management
- Author
- Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Exchange management activity where a certificate request export (New-ExchangeCertificate with request file generation and binary encoding) writes the CSR to an unusual local webserver-accessible location. Attackers may abuse the ability to write files to place malicious content in a directory that is served by a web server, including paths and filenames with an .aspx suffix. The detection relies on command and parameter telemetry from the Exchange management service, matching specific export command components and suspicious path patterns.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Exchange Management: Certificate CSR exported to webserver or .aspx-named path"
id: 4b81c2c9-9221-42de-9b6e-8976de1e2382
status: test
description: This rule identifies Exchange management activity where a certificate request export (New-ExchangeCertificate with request file generation and binary encoding) writes the CSR to an unusual local webserver-accessible location. Attackers may abuse the ability to write files to place malicious content in a directory that is served by a web server, including paths and filenames with an .aspx suffix. The detection relies on command and parameter telemetry from the Exchange management service, matching specific export command components and suspicious path patterns.
references:
- https://twitter.com/GossiTheDog/status/1429175908905127938
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2023-01-23
tags:
- attack.persistence
- attack.t1505.003
logsource:
service: msexchange-management
product: windows
detection:
keywords_export_command:
"|all":
- New-ExchangeCertificate
- " -GenerateRequest"
- " -BinaryEncoded"
- " -RequestFile"
keywords_export_params:
- \\\\localhost\\C$
- \\\\127.0.0.1\\C$
- C:\\inetpub
- .aspx
condition: keywords_export_command and keywords_export_params
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: b7bc7038-638b-4ffd-880c-292c692209ef
type: derived