Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend
Flags webserver POSTs returning 200 that request both /owa/mastermailbox and /powershell, consistent with OWASSRF exploitation attempts.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags webserver activity that matches a successful HTTP POST (status 200) to OWA endpoints containing both /owa/mastermailbox and /powershell, with a specific browser-like User-Agent and request pattern. Such traffic is consistent with OWASSRF-style attempts to reach a PowerShell backend through public OWA paths. Telemetry relies on webserver HTTP request fields including User-Agent, method, status, and the requested URI query.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- rapid7.comhttps://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
- twitter.comhttps://twitter.com/purp1ew0lf/status/1602989967776808961?s=12&t=OkZJl_ViICeiftVEsohRyw
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_poc_exploitation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend"
id: ee940385-b00d-462a-826b-450cb1922280
status: test
description: This rule flags webserver activity that matches a successful HTTP POST (status 200) to OWA endpoints containing both /owa/mastermailbox and /powershell, with a specific browser-like User-Agent and request pattern. Such traffic is consistent with OWASSRF-style attempts to reach a PowerShell backend through public OWA paths. Telemetry relies on webserver HTTP request fields including User-Agent, method, status, and the requested URI query.
references:
- https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
- https://twitter.com/purp1ew0lf/status/1602989967776808961?s=12&t=OkZJl_ViICeiftVEsohRyw
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_poc_exploitation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-22
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36
cs-method: POST
sc-status: 200
cs-uri-query|contains|all:
- /owa/mastermailbox
- /powershell
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 92d78c63-5a5c-4c40-9b60-463810ffb082
type: derived