Microsoft Exchange exploitation attempt behavior for CVE-2021-28480 via OWA calendar POST

Flags POST requests to OWA calendar endpoint patterns linked to CVE-2021-28480, excluding HTTP 503 responses.

FreeUnreviewedSigmacriticalv1

microsoft-exchange-exploitation-attempt-behavior-for-cve-2021-28480-via-owa-cale-a2a9d722

title: Microsoft Exchange exploitation attempt behavior for CVE-2021-28480 via OWA calendar POST
id: 166f749c-dea5-4a5b-9ef9-03df848780c2
status: test
description: This rule identifies web requests consistent with successful exploitation activity targeting Microsoft Exchange OWA calendar functionality associated with CVE-2021-28480. Attackers may leverage this path to gain unauthorized access by sending crafted HTTP POST requests to a specific OWA calendar endpoint. The detection relies on webserver telemetry capturing request method (POST), URI query contents, and HTTP status codes, excluding cases where a main status field indicates 503.
references:
  - https://twitter.com/GossiTheDog/status/1392965209132871683?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-28480/web_cve_2021_28480_exchange_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-14
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-28480
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /owa/calendar/a
    cs-method: POST
  filter_main_status:
    sc-status: 503
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: a2a9d722-0acb-4096-bccc-daaf91a5037b
    type: derived

What it detects

This rule identifies web requests consistent with successful exploitation activity targeting Microsoft Exchange OWA calendar functionality associated with CVE-2021-28480. Attackers may leverage this path to gain unauthorized access by sending crafted HTTP POST requests to a specific OWA calendar endpoint. The detection relies on webserver telemetry capturing request method (POST), URI query contents, and HTTP status codes, excluding cases where a main status field indicates 503.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.