Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Exchange Management activity where Set-OabVirtualDirectory is used to modify the ExternalUrl property with script-related content, including Page_Load and script. Attackers may use this to persist malicious behavior by pointing Exchange-controlled components to executable script logic. The detection relies on msexchange-management telemetry captured as keyword matches across the command/output text.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange

Possible Ivanti Connect Secure Webshell Access

Malicious Shell Spawned by SharePoint Worker Process w3wp

Suspicious SD-WAN Compromise JSP Webshell Access

Malicious AquaShell Webshell Access on Cisco Secure Email Gateway by UAT-9686

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)

Suspicious Web Shell File Written to IIS wwwroot Directory

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369

Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

Pivot detection · T1505.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-exchange-management-set-oabvirtualdirectory-externalurl-script-injecti-9db37458

title: "Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content"
id: a9443585-d444-40dd-adf0-366266605c7d
status: test
description: This rule flags Exchange Management activity where Set-OabVirtualDirectory is used to modify the ExternalUrl property with script-related content, including Page_Load and script. Attackers may use this to persist malicious behavior by pointing Exchange-controlled components to executable script logic. The detection relies on msexchange-management telemetry captured as keyword matches across the command/output text.
references:
  - https://twitter.com/OTR_Community/status/1371053369071132675
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml
author: Jose Rodriguez @Cyb3rPandaH, Huntrule Team
date: 2021-03-15
modified: 2023-01-23
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  service: msexchange-management
detection:
  keywords:
    "|all":
      - Set-OabVirtualDirectory
      - ExternalUrl
      - Page_Load
      - script
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9db37458-4df2-46a5-95ab-307e7f29e675
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL