Microsoft Exchange exploitation web requests using ECP/OWA and __VIEWSTATE (HTTP GET)

title: Microsoft Exchange exploitation web requests using ECP/OWA and __VIEWSTATE (HTTP GET)
id: 04f815d0-3dbe-49f2-bcf5-be419cb1b457
status: test
description: This rule flags HTTP GET requests whose URL query contains both Exchange-related paths (/ecp/ and /owa/) and the __VIEWSTATE= parameter. Attackers often use vulnerable Exchange endpoints and crafted viewstate values to trigger malicious behavior through the web interface. The detection relies on webserver request telemetry capturing the HTTP method and the full URI query string.
references:
  - https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-02-29
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2020-0688
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-method: GET
    cs-uri-query|contains:
      - /ecp/
      - /owa/
  selection2:
    cs-uri-query|contains: __VIEWSTATE=
  condition: all of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: fce2c2e2-0fb5-41ab-a14c-5391e1fd70a5
    type: derived