Detect OWASSRF Webserver Exploitation Pattern Targeting PowerShell Backend
Alerts on successful POST requests to OWA URLs containing PowerShell backend indicators and Exchange-like probe user agents.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule looks for HTTP POST requests that return successful status codes while the requested query path includes both the /owa/ and /powershell backend components, along with an @-encoded user/endpoint indicator. It matters because OWASSRF-style abuse can leverage the Exchange web-facing endpoint to reach the PowerShell backend, potentially enabling further compromise. The detection relies on webserver telemetry fields for HTTP method, response status, full URI query content, and specific user-agent values associated with backend probing.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- rapid7.comhttps://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Detect OWASSRF Webserver Exploitation Pattern Targeting PowerShell Backend
id: bc7bd953-86ef-455d-ad9b-2efb203f54b0
status: test
description: This rule looks for HTTP POST requests that return successful status codes while the requested query path includes both the /owa/ and /powershell backend components, along with an @-encoded user/endpoint indicator. It matters because OWASSRF-style abuse can leverage the Exchange web-facing endpoint to reach the PowerShell backend, potentially enabling further compromise. The detection relies on webserver telemetry fields for HTTP method, response status, full URI query content, and specific user-agent values associated with backend probing.
references:
- https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
- https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-22
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: POST
sc-status: 200
cs-uri-query|contains|all:
- /owa/
- /powershell
cs-uri-query|contains:
- "@"
- "%40"
filter_main_ua:
cs-user-agent:
- ClientInfo
- Microsoft WinRM Client
- Exchange BackEnd Probes
condition: selection and not 1 of filter_main_*
falsepositives:
- Web vulnerability scanners
level: high
license: DRL-1.1
related:
- id: 181f49fa-0b21-4665-a98c-a57025ebb8c7
type: derived