Microsoft Exchange Management: Set-OabVirtualDirectory ExternalUrl script injection via OAB Page_Load

Detects Exchange Management changes to OAB ExternalUrl containing script indicators and Page_Load.

FreeUnreviewedSigmahighv1

microsoft-exchange-management-set-oabvirtualdirectory-externalurl-script-injecti-9db37458

title: "Microsoft Exchange Management: Set-OabVirtualDirectory ExternalUrl script injection via OAB Page_Load"
id: a9443585-d444-40dd-adf0-366266605c7d
status: test
description: This rule flags Exchange Management activity where the Set-OabVirtualDirectory command sets the ExternalUrl property to a value containing script content, including Page_Load and the word script. Attackers may use the OAB virtual directory external URL to host or reference executable script content for persistence or execution. The detection relies on Windows msexchange-management telemetry matching the presence of Set-OabVirtualDirectory, ExternalUrl, Page_Load, and script within the logged command text.
references:
  - https://twitter.com/OTR_Community/status/1371053369071132675
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml
author: Jose Rodriguez @Cyb3rPandaH, Huntrule Team
date: 2021-03-15
modified: 2023-01-23
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  service: msexchange-management
detection:
  keywords:
    "|all":
      - Set-OabVirtualDirectory
      - ExternalUrl
      - Page_Load
      - script
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9db37458-4df2-46a5-95ab-307e7f29e675
    type: derived

What it detects

This rule flags Exchange Management activity where the Set-OabVirtualDirectory command sets the ExternalUrl property to a value containing script content, including Page_Load and the word script. Attackers may use the OAB virtual directory external URL to host or reference executable script content for persistence or execution. The detection relies on Windows msexchange-management telemetry matching the presence of Set-OabVirtualDirectory, ExternalUrl, Page_Load, and script within the logged command text.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.