Proxy HTTP POST to OWA PowerShell Backend with Encoded User Info (OWASSRF)

title: Proxy HTTP POST to OWA PowerShell Backend with Encoded User Info (OWASSRF)
id: 7e38801b-78f8-43e0-905b-32d69d27d6d1
status: test
description: This rule flags successful HTTP POST requests through a proxy where the request URI contains both OWA and a PowerShell backend path, along with encoded or embedded user information indicators. An attacker could use these patterns to reach the Exchange PowerShell backend via the OWA endpoint, which can enable server-side compromise. It relies on proxy web access telemetry, matching HTTP method, status code, requested URI substrings, and specific user-agent values associated with backend probing behavior.
references:
  - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
  - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_exploitation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-22
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: POST
    sc-status: 200
    c-uri|contains|all:
      - /owa/
      - /powershell
    c-uri|contains:
      - "@"
      - "%40"
  filter_main_ua:
    c-useragent:
      - ClientInfo
      - Microsoft WinRM Client
      - Exchange BackEnd Probes
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Web vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 1ddf4596-1908-43c9-add2-1d2c2fcc4797
    type: derived